MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55ead005d1ba374a40966ed2225c2e5fcb6dcc773a9ba45f33fc4942b2c71d8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55ead005d1ba374a40966ed2225c2e5fcb6dcc773a9ba45f33fc4942b2c71d8e
SHA3-384 hash: d23c8c63f0ae112b2a87ca041a2b9d531b37cf4408aca53600d1877d8960b111d07ab25cdac47c7b2b2a40ec32e20cc7
SHA1 hash: 985078c9de2e258ee0f68a6ff040f1aaea37434e
MD5 hash: 24744982819f71d3863dc49430412513
humanhash: london-ink-five-carpet
File name:SCAN-QMJ201706001-1 KIS 030212836A - 29 JuLY 2020.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:470'607 bytes
First seen:2020-07-29 05:46:30 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:xh0ry856KexYw54XiWjJuQc8tHKlL3dlHJzZLV3:Pj856Kexr4XiWjJpcIKlNlHJVV3
TLSH 98A423B2684278D8352A95DBF2F4FA3A59C838079905F072344BFAE6DDB6339904C6C5
Reporter abuse_ch
Tags:AgentTesla arj HostGator


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gateway32.websitewelcome.com
Sending IP: 192.185.145.122
From: info@bemilnigeria.com
Reply-To: 'Delphine LOW <vifuentes@yahoo.com>
Subject: RFQ for Butterfly Valve
Attachment: SCAN-QMJ201706001-1 KIS 030212836A - 29 JuLY 2020.arj (contains "SCAN-QMJ201706001-1 ( KIS ) 030212836A - 29 JuLY 2020.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/55ead005d1ba374a40966ed2225c2e5fcb6dcc773a9ba45f33fc4942b2c71d8e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 05:48:09 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kxvnaborxi3uuqewn3jcexbol7fw3tdxhkn2ixzt7reufmwhdwha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/55ead005d1ba374a40966ed2225c2e5fcb6dcc773a9ba45f33fc4942b2c71d8e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 55ead005d1ba374a40966ed2225c2e5fcb6dcc773a9ba45f33fc4942b2c71d8e

(this sample)

AgentTesla

Executable exe 66ace62e0ede33040b4cfcccff43456f23c9867db05baf7c8e232391b284bf49

  
Dropping
MD5 d717ba1b37764696d10b5230a402d2b1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 66ace62e0ede33040b4cfcccff43456f23c9867db05baf7c8e232391b284bf49

Comments