MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5810ed47a23de7ade7c55c218ac192f517f653b3bd7989968639c02446031f54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5810ed47a23de7ade7c55c218ac192f517f653b3bd7989968639c02446031f54
SHA3-384 hash: d9d0700a748e67266279730699cfc841f1a7892f43923e799e454ffa928eb8071a4cb4185e88152f53b2fabc5c802671
SHA1 hash: 426c055e5979597fb3685c1b12ecc4624113c265
MD5 hash: 8ed56080d0aad141abadc8869d140966
humanhash: earth-kitten-ten-golf
File name:doc 2020051__0019949030001.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:963'124 bytes
First seen:2020-05-01 14:18:51 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 24576:8mwSTO7o8cKlsOA+sNnU1DyCdAb7RUgYg4Uc:6SSs8cmOGDZSE
TLSH 432533B3C708A28732E417252B104E6A1356399D2920557B3F8787FA3B2775B78E173B
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp.ostec-qroup.ru
Sending IP: 104.168.253.210
From: Elena Jiménez <info@ostec-qroup.ru>
Reply-To: fosuji@yandex.com
Subject: RUTAIR INTERNATIONAL,S.L. RFQ EV24122019 INQUIRY
Attachment: doc 2020051__0019949030001.r00 (contains "doc 2020051__0019949030001.exe")

AgentTesla SMTP exfil server:
mail.newtorres.com:587 (94.73.172.8)

AgentTesla SMTP exfil email address:
buseaksoy@newtorres.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 14:36:04 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=laio2r5chxt23z6flqqyvqms6ul7mu5txv4ytfughhacirqdd5ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 5810ed47a23de7ade7c55c218ac192f517f653b3bd7989968639c02446031f54

(this sample)

AgentTesla

Executable exe 9fe8d0a4c61217e8478e89cb7452706f5b52a4b4e42cf7af98e32e2faa7a2d7a

  
Dropping
MD5 e89e05b53669ea63e7120b4113b25e60
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9fe8d0a4c61217e8478e89cb7452706f5b52a4b4e42cf7af98e32e2faa7a2d7a

Comments