MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 863567b94160cb5071120ca40b9146389cae313bf04382a17184dc1c87ecb74a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 863567b94160cb5071120ca40b9146389cae313bf04382a17184dc1c87ecb74a
SHA3-384 hash: 77a4b08f27cb334f0570bae2896da53eff5feba0c1e673fbab4428772a29e0d2a2f3d516b2a78adc35dab5efa240d01d
SHA1 hash: aed446d67787e1d5df65e276cef9228f7fbd07fe
MD5 hash: ca24eccc4d8c65ced4651ab633e055c1
humanhash: sweet-dakota-oscar-oklahoma
File name:scannned_745645645787.r01
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'035'534 bytes
First seen:2020-05-13 16:33:22 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 24576:TdJXru7rA0etbOHyt/OwO9HDcXtbqe1yzrtyFBw7JG/ad:T4kSHyJOwOxcX1LycFBw8o
TLSH E7253379025C7B1477C5EEF88DD5964FEEBC038679BF600E0D52E29889F68D2D94C128
Reporter abuse_ch
Tags:AgentTesla r01


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: winpro1.internet-webhosting.com
Sending IP: 103.8.24.77
From: <hr@megamart.com.my>
Subject: FW: PAYMENT ADVISE
Attachment: scannned_745645645787.r01 (contains "scannned_745645645787.scr")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 16:36:19 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qy2wpokbmdfva4isbssaxekghcok4mj36bbyfilrqtobzb7mw5fa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 863567b94160cb5071120ca40b9146389cae313bf04382a17184dc1c87ecb74a

(this sample)

AgentTesla

Executable exe 0bafae31d44317689ed165b1e92fef4b999479ad040cc371d021bb5c50cdf69f

  
Dropping
MD5 ea07033137c25fe6b16f7a1d6231db7b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0bafae31d44317689ed165b1e92fef4b999479ad040cc371d021bb5c50cdf69f

Comments