MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a4bd11e5ecb5eb27f9078d17d017c2fdce36f52e15f90161c64c0272a3e00fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a4bd11e5ecb5eb27f9078d17d017c2fdce36f52e15f90161c64c0272a3e00fd
SHA3-384 hash: da2b28d8b30d364f66838b3ba53a280387409a7998c30b8443df944ed58c4ad1371dd1bbea127de48c31826143fe9c6e
SHA1 hash: 85b615a3a95e7f6e599838e2ab5c46289858ed63
MD5 hash: 7122e4dd826c9dc9b10ed4d88021e0c4
humanhash: lemon-jersey-edward-lamp
File name:Order Images.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:294'389 bytes
First seen:2020-08-06 05:26:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:o1ZyIE8JMBddXdntK/DewdelmUlh8ltSvFdL1JX:CZ6VubulmS8ltUd7
TLSH 2F54230E7BB18E83602718A5512E39DD05C051BCB679FFE3EA40F16C4AF690269E496F
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.genogan.ga
Sending IP: 45.147.162.107
From: Cristina Favreto <admin@genogan.ga>
Subject: Fwd: Re: Order Inquiry and supply
Attachment: Order Images.rar (contains "Order & Images.exe")

AgentTesla SMTP exfil server:
smtp.skybarnds.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a4bd11e5ecb5eb27f9078d17d017c2fdce36f52e15f90161c64c0272a3e00fd/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Suspicious
First seen:
2020-08-06 05:28:08 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rjf5chs6znple74qpdix2al4f7oog32s4fpzafq4mtacokr6ad6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8a4bd11e5ecb5eb27f9078d17d017c2fdce36f52e15f90161c64c0272a3e00fd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 8a4bd11e5ecb5eb27f9078d17d017c2fdce36f52e15f90161c64c0272a3e00fd

(this sample)

AgentTesla

Executable exe 1ef829bc1993a01681f50af586d81c35f31455dd8263d422888761eb420687cb

  
Dropping
MD5 d26ebcb014e7754addfc58188459895c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1ef829bc1993a01681f50af586d81c35f31455dd8263d422888761eb420687cb

Comments