MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98d8f300efd4db1cfc1db9a28904bbf273b38534b416fbd7d3d78885cc73d014. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98d8f300efd4db1cfc1db9a28904bbf273b38534b416fbd7d3d78885cc73d014
SHA3-384 hash: d8ae76fa4b03eb156056c22a8ae3ebb27309e8bc78bb0dba111112dc5804042e2cff983a6e6cb17272b330ced87455b1
SHA1 hash: d51a4151b3c7a57542b5908cf344bf02d76fbb82
MD5 hash: 2d10396286e546b8ecc44648173ed22a
humanhash: freddie-emma-zulu-king
File name:RFQ_C73639811.PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'292 bytes
First seen:2020-06-30 13:25:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:PyWIQ65TiVSMkoJZmTbyDKH8sKSOpS+oXDRYFXRS5zq8zPjLR4tUNR+yiFbOb0pq:qogjMkrnGSDOpS+o4XR8Xl0yWbQ0u6s
TLSH A29423D4D8FF414B122EEAD5CED6FFE40D1827315C252BB99875BAC70844986B3F1A82
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.sattisleather.community
Sending IP: 162.241.205.0
From: John <info@sattisleather.community>
Subject: RE: Quotation Enquiry
Attachment: RFQ_C73639811.PDF.rar (contains "RFQ_C73639811.PDF.exe")

AgentTesla SMTP exfil server:
smtp.cdldxy-cn.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98d8f300efd4db1cfc1db9a28904bbf273b38534b416fbd7d3d78885cc73d014/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 13:27:04 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tdmpgahp2tnrz7a5xgrisbf36jz3hbjuwqlpxv6t26eiltdt2aka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 98d8f300efd4db1cfc1db9a28904bbf273b38534b416fbd7d3d78885cc73d014

(this sample)

AgentTesla

Executable exe d872c84aaa87d90521400f1d6052524e0d2256b3d865aeaad679beea3919a49e

  
Dropping
MD5 6f5505f192e637d38811991f4f62b81a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d872c84aaa87d90521400f1d6052524e0d2256b3d865aeaad679beea3919a49e

Comments