MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8661ff0f8ac33a0d53226a6a19fec8100fb28f88665f49a1144eb2c6b4cc72e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8661ff0f8ac33a0d53226a6a19fec8100fb28f88665f49a1144eb2c6b4cc72e6
SHA3-384 hash: 83274eb2ed746f3b219d77686dceec55220ca57f26bd373a3ee2cf8c43c7a8bda09f24c12776c4141d8bce5d6b35b542
SHA1 hash: 010f1af06408d85f429fdfbf0cad55b6b4c9df0e
MD5 hash: beb0c52a65d882c8d2054a1af077f9f3
humanhash: jersey-foxtrot-johnny-seven
File name:Request For Quotation.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:886'353 bytes
First seen:2020-06-15 12:06:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:vfbjfgO+X+BubufBxtjXDK3z8QdMdifE01We:vf3o6BubI7+3AQd/x
TLSH 3B15337851D20F6328FA395FFDB7DF8451AAAEAEA23808838AD3DD6B1C70D50D553604
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: WIN-DOP26BTMO11.home
Sending IP: 101.53.156.207
From: <bill@delhigymkhana.org.in>
Subject: po
Attachment: Request For Quotation.rar (contains "Request For Quotation.exe")

AgentTesla SMTP exfil server:
smtp.olaviqs.us:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 12:08:04 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qzq76d4kym5a2uzcnjvbt7wicah3fd4imzputiiuj2zmnngmolta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 8661ff0f8ac33a0d53226a6a19fec8100fb28f88665f49a1144eb2c6b4cc72e6

(this sample)

AgentTesla

Executable exe 398377f9ae0ed71b8942752ae63497e1a4a6535523d3755d0a2a1d0c439fd9d9

  
Dropping
MD5 d957577eb9b5a78c9889a84b275fdb34
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 398377f9ae0ed71b8942752ae63497e1a4a6535523d3755d0a2a1d0c439fd9d9

Comments