MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 618040cf5a9fe4040090407792cd374117473aceff8b5e8d05cee2d4e2e60bb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 618040cf5a9fe4040090407792cd374117473aceff8b5e8d05cee2d4e2e60bb8
SHA3-384 hash: 34fe0256409ef9e5e8d7f18454f4a7e153261043e757b191cc63ebcc3707f034218604360a041c5df343c557e173987a
SHA1 hash: 5eae166d47a3c2c836719cae5c02b0c32fb49455
MD5 hash: a89efbc0a9753682a1dea6085a08cfd7
humanhash: football-missouri-alaska-florida
File name:Purchase order from Arrow Electronics Components.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:756'038 bytes
First seen:2020-06-15 12:21:26 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:MgWu75wR7oi8/Gc8ckJhnVMgWu75wR7oi8/Gc8ckJhnVb:RP7KR7oGlpRP7KR7oGlpb
TLSH A2F423A31E826C84B1197C0A8581EE5F725F75773B712CEDBBD14BE5F1AE7A06800E50
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.neileshventures.com
Sending IP: 162.241.215.152
From: Liu Jianguo <liujianguo.singapore@arrow.com>
Reply-To: Liu Jianguo <liujianguo.singapore@arrow.com>
Subject: REQUEST FOR QUOTATION - Arrow Electronics Components
Attachment: Purchase order from Arrow Electronics Components.rar (contains "Tender Documents Arrow Electronics Components.exe")

AgentTesla SMTP exfil server:
mail.ontime.com.ph:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 12:23:11 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mgaebt22t7saiaeqib3zftjxieluoowo76fv5difz3rnjyxgbo4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 618040cf5a9fe4040090407792cd374117473aceff8b5e8d05cee2d4e2e60bb8

(this sample)

AgentTesla

Executable exe b4ccf43f4738a566c201a3320e7ed4a49454359e8d85cc2470fd3caa820d4e29

  
Dropping
MD5 f094dca28a6ce2605e0fbbf5a119807e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b4ccf43f4738a566c201a3320e7ed4a49454359e8d85cc2470fd3caa820d4e29

Comments