MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7638a1f0cd2a16fd467148f7e157dd063e29b9b6150c87f63d051148e43cce96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7638a1f0cd2a16fd467148f7e157dd063e29b9b6150c87f63d051148e43cce96
SHA3-384 hash: 1489884ed18f19ac27b75206477847e1477338cc847327ccf928006a33eaaa0bc3d55f9ab1f4cfbf8ff60e08c20f8fde
SHA1 hash: 586990a5f6bb073786b12a35d24ea08d6072a4af
MD5 hash: ff3784fb21d2ae70a50c17cb5917553f
humanhash: beer-uncle-kentucky-triple
File name:Inquiry Order.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:457'065 bytes
First seen:2020-05-13 15:45:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:f92IxZU5/MfXzDx3ERCDPc9l8pG0v1vP/ID0ITh1Ju+hhg:wyZU5/Mfp3r+ZCNID0ITh1Xg
TLSH A2A4232405CD949B37226DD12A11A0C7F6B3DE8138AEB294BFCD85079B91C55E8E8FC7
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx79.dns.com.cn
Sending IP: 180.76.192.79
From: formin <formin@formin.com.cn>
Subject: AW: Inquiry Order
Attachment: Inquiry Order.rar (contains "Inquiry Order.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 16:36:15 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oy4kd4gnfilp2rtrjd36cv65ay7ctonwcugip5r5auiurzb4z2la._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 7638a1f0cd2a16fd467148f7e157dd063e29b9b6150c87f63d051148e43cce96

(this sample)

AgentTesla

Executable exe 38784e09ac572a99811a368a4cc4ba28f949b2ada8f0ce426de03a0bf7c2ee99

  
Dropping
MD5 2b4d42d23470710d430c0f917fc4609e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 38784e09ac572a99811a368a4cc4ba28f949b2ada8f0ce426de03a0bf7c2ee99

Comments