MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a204598c9e3e26f8316f1f3c99498607839666477d8816eb08007f56de2c6079. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a204598c9e3e26f8316f1f3c99498607839666477d8816eb08007f56de2c6079
SHA3-384 hash: 675b7ae932d9e047f0052a7fe4c35b0c1954adcc4c7de796da93c7d49e228d6cfdd12eba5b18831063d87c118d622aed
SHA1 hash: a902d3d07bdb908abf58fa2400318258805165fe
MD5 hash: 4b9753422040ead2dae94fbdbb8b6b2f
humanhash: august-connecticut-eighteen-skylark
File name:fra_02019.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:392'720 bytes
First seen:2020-05-19 08:05:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:MPZ77YsF2ZWbdTamq8ugBq2HN5iDQlC2CC2LzdyMhdxV+vDTcZ91C1MxZ:MPZnYsF1bfq8DTNQwC5Cy5xm4XZ
TLSH 2B84231E831E5D04FE5D120C5C4DA15BDCC5E10AB8187DA4CA88A107FE89EBDDBADA1F
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ultron8.titaniumsystem.es
Sending IP: 144.76.174.186
From: Ernesto Jose Valls Fernandez <ernesto.vaIls@acerinox.com>
Subject: FACTURA Nº 00-004994-2020
Attachment: fra_02019.rar (contains "FACTURA VENCIDA.exe")

AgentTesla SMTP exfil server:
mail.araneta.es:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.6078.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 08:35:58 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uicftde6hytpqmlpd46jssmga6bzmzshpwebn2yiab7vnxrmmb4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a204598c9e3e26f8316f1f3c99498607839666477d8816eb08007f56de2c6079

(this sample)

AgentTesla

Executable exe 1890ab9f7e4107096420bd8f0f5d7ff1a84d7b02c691675b70cf3382fda0a81a

  
Dropping
MD5 e15587091feb670cf83c48b147e8e621
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1890ab9f7e4107096420bd8f0f5d7ff1a84d7b02c691675b70cf3382fda0a81a

Comments