MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92b555b8d5da68975c112a961a0c71abd8d332de861d0b0f196389cdf998f982. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92b555b8d5da68975c112a961a0c71abd8d332de861d0b0f196389cdf998f982
SHA3-384 hash: 923419fe44ae3a6f83439806a31a5e5a49e6408a0c1160f9e11ebd8e909ea512d160bd19579feea1805fe2829a41bea2
SHA1 hash: c69673c876405c0f2a91a6121bf19931a72b1e33
MD5 hash: ac7206568419247de3652b5168a63cc5
humanhash: edward-eleven-leopard-ceiling
File name:20200527061638652538255382538253752532.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:961'893 bytes
First seen:2020-05-27 07:16:36 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:YX2/myd/41MuIYxkQ9zdeZ2j6MwbNgcljUtRn6CSFf9bY+U+3hUmUEhAqWfOI:A+Rd/ZuIZSh1mxgrlYdUyhUL71fz
TLSH A61533914C0D55FD40899720C316DE6F6BD39EEBDF8F128C93C6B38266AAD28DEB4045
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: x2sat.com
Sending IP: 156.96.45.138
From: Wang (王月香) <areo@x2sat.com>
Subject: 回复: RE: Price
Attachment: 20200527061638652538255382538253752532.r00 (contains "20200527061638652538255382538253752532.exe")

AgentTesla SMTP exfil server:
mail.brightpackaging.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 07:36:18 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 92b555b8d5da68975c112a961a0c71abd8d332de861d0b0f196389cdf998f982

(this sample)

AgentTesla

Executable exe 87ffc10662d1c23c3ad3affff164435dd792443961ac825665aa9adf38cfe368

  
Dropping
MD5 b0ce1a22cbb17b94698f6bce76608dc4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 87ffc10662d1c23c3ad3affff164435dd792443961ac825665aa9adf38cfe368

Comments