MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ae2801911fe1a3f3a658e92aa56f2fa64b6838c6dd5e568d0c2606f0508e10b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ae2801911fe1a3f3a658e92aa56f2fa64b6838c6dd5e568d0c2606f0508e10b
SHA3-384 hash: 3493cd2113313a9d6b107f333ebf85acee9ce5ed10a78ddcf6e12563976e54437994b50f45449f7183002612158cc0c4
SHA1 hash: ce4223bcd76e0705707489a32274d0ee9c82b3b8
MD5 hash: c00485b785ae12c5d6bd8402365664c7
humanhash: eight-quiet-uranus-wyoming
File name:CompaniesListing2020_Office_USE_ONLY.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:439'901 bytes
First seen:2020-05-26 16:12:04 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:EgFjLehimUj7LFVgzIZK+KnXZx6A+ZsDqzX:nc8jnFVgzhtXZ0FZsDeX
TLSH 2E9423844FCA5775138CEEB652A4F4B34A53DF865ECDC5D994A38088685BAC2C3CB31E
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vtv.by
Sending IP: 93.84.117.238
From: Hector Hermosillo <hhermosillo@lindit.com>
Subject: Re: Contact Information Request/COVID 19 Request
Attachment: CompaniesListing2020_Office_USE_ONLY.rar (contains "CompaniesListing2020_Office_USE_ONLY.exe")

AgentTesla SMTP exfil server:
mail.fsicibd.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 16:36:20 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 8ae2801911fe1a3f3a658e92aa56f2fa64b6838c6dd5e568d0c2606f0508e10b

(this sample)

AgentTesla

Executable exe 3a062094e4e4f6e4d0b2e81c2c8821a82e599d668faf93614bd7063cad01d690

  
Dropping
MD5 d6ae3cd904a77882aa5f0cfb0b997de6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a062094e4e4f6e4d0b2e81c2c8821a82e599d668faf93614bd7063cad01d690

Comments