MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46d5d6d2616b35c92f9c287156dfeec7246d474ad94f3742308ccf5e7a7efd43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46d5d6d2616b35c92f9c287156dfeec7246d474ad94f3742308ccf5e7a7efd43
SHA3-384 hash: eefbb071b3566f19798db0e4ab4606fdefdace530630a199394f9cf3c6a90c3ea55e74f105527c2c2b7a75da18b2048d
SHA1 hash: 8a97fddb40f8a050b91e83a84c0df3bf6b396834
MD5 hash: fb707daec7367ab49ab0e73f8529686a
humanhash: idaho-florida-oregon-nebraska
File name:PO-05199BL.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:485'767 bytes
First seen:2020-05-01 12:58:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:4QTjJxTxzGeTqqTbAqr4gqoAa82C0TCYME:TfVGfqt+oAXgTCYN
TLSH A2A423AFC1B7BC81513F64204539BA8A0CCEF818A55F3C889A4449047BD96F7BD51F6B
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtpout1.mo804.mail-out.ovh.net
Sending IP: 79.137.123.220
From: salhabenamara <salhabenamara@imen-tunisia.com>
Subject: Inquiry
Attachment: PO-05199BL.rar (contains "PO-05199BL.exe")

AgentTesla SMTP exfil server:
mail.bnshotel.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 13:35:42 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i3k5nutbnm24sl44fbyvnx7oy4sg2r2k3fhtoqrqrthv46t67vbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 46d5d6d2616b35c92f9c287156dfeec7246d474ad94f3742308ccf5e7a7efd43

(this sample)

AgentTesla

Executable exe 803cee37035d8ac4f93a8aea49c08e63b421ea1faf6f5778ad1f882bc16ce414

  
Dropping
MD5 86e212dd5626ae84988ccd3020a40af2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 803cee37035d8ac4f93a8aea49c08e63b421ea1faf6f5778ad1f882bc16ce414

Comments