MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 616e5bad9b498b536dbfffadfc950ef27b5b25668f43687589ee8cd5e0fea6f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 616e5bad9b498b536dbfffadfc950ef27b5b25668f43687589ee8cd5e0fea6f9
SHA3-384 hash: a637969a69ee0581a153e7a97027710d36084010d3162d7ccc96783cb672f1398ea9779ff2a0f31f17c87ac763170045
SHA1 hash: e63d7b347cfd7eab19519f3c03af2642c2e422b6
MD5 hash: a985892489ac380c19af142c73ee063f
humanhash: whiskey-beryllium-potato-magazine
File name:8448198682.pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:403'041 bytes
First seen:2020-05-25 12:17:16 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Bk1I6yeG8cxiN68IBOkyZUypYjB6rcAzLLJvwFOcOcjdmlvZ2sJ5ICx:aecGpxU6dBuZUZ644RwFFOcoCsJKCx
TLSH 7184236BE3D4192A9827436BDA413C84D47CDBB179329D67333ECD3C56E9340A7EA224
Reporter abuse_ch
Tags:AgentTesla DHL rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns1.enda-karina.pw
Sending IP: 173.82.187.84
From: Patricia De la Cruz Hidalgo <Patricia.DelaCruz@dhl.com>
Subject: RV: ENVIO DHL 8448198682
Attachment: 8448198682.pdf.rar (contains "R9OcMO6t8rgOoUs.exe")

AgentTesla SMTP exfil server:
smtp.mail.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 12:37:00 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
27 of 48 (56.25%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 616e5bad9b498b536dbfffadfc950ef27b5b25668f43687589ee8cd5e0fea6f9

(this sample)

AgentTesla

Executable exe 369d6df809f8f35c1c776a79047f9e25abfd59424982e367ab4de0d3bd45e4a8

  
Dropping
MD5 64b69fcdff662a73a0c446535d2e898f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 369d6df809f8f35c1c776a79047f9e25abfd59424982e367ab4de0d3bd45e4a8

Comments