MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9386732db308ce236ac34db2c3bd9a24f74b5a2c4c86afabf42381e469883899. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9386732db308ce236ac34db2c3bd9a24f74b5a2c4c86afabf42381e469883899
SHA3-384 hash: 1e565c196e7ad8cb5153fafa3f27c64ce5ce11eb512981347a03fb1d9deadc13626fddf0552053c2202d6acd272f42b1
SHA1 hash: cba427be4a35a6ee11f69baecd9eeccd54171b27
MD5 hash: 168bf4ff9cc0f407591ecdf847c7bfd8
humanhash: butter-music-alpha-west
File name:PO-109081.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:384'031 bytes
First seen:2020-07-10 09:22:26 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:W52DzkGRpvhNNCttzEVYzaLP43qUd4/0CG8sTXgVFOHb71Xg6P4zZtV2VFpHq:WqzkGJn+VzaLPOo0xvg63JHgVtV2xq
TLSH AB842321633CA3AE99D479123A6DC89B65DDBC254CF5EB94DA4088C93E7324189D83CF
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: srv.newton.co.id
Sending IP: 103.253.115.37
From: Ahsan.khaliq <ahsan.khaliq@multinet.com.pk>
Subject: PO-109081
Attachment: PO-109081.r00 (contains "PO-109081.exe")

AgentTesla SMTP exfil server:
smtp.altrii.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9386732db308ce236ac34db2c3bd9a24f74b5a2c4c86afabf42381e469883899/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 09:24:07 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sodhglntbdhcg2wdjwzmhpm2et3uwwrmjsdk7k7ueoa6i2mihcmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 9386732db308ce236ac34db2c3bd9a24f74b5a2c4c86afabf42381e469883899

(this sample)

AgentTesla

Executable exe a933c548ff13dde658dd6c020ce8983f95bb6cdc70fe01721cdc31e55122b17e

  
Dropping
MD5 86ed49470a2556c7e918e1fb014f1595
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a933c548ff13dde658dd6c020ce8983f95bb6cdc70fe01721cdc31e55122b17e

Comments