MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a306c1bf6ee9feec63bd333440b0b042bed171e614b969c67b1cf915f2586195. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a306c1bf6ee9feec63bd333440b0b042bed171e614b969c67b1cf915f2586195
SHA3-384 hash: 7a6a67409e1a8cb7bdd804b7b86fca4c6ec2b19d8c74ce5bbf553d4f8eb76a88b7d038fcc40e2a6ffc21bccf3c4d64c0
SHA1 hash: 763919886e1aef9b117f8f2344473249b8d36f13
MD5 hash: bf2cf08bdf7e7f2862434a64065feeb9
humanhash: foxtrot-tennessee-wyoming-stream
File name:Order List.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:531'212 bytes
First seen:2020-08-03 11:35:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:4jXhyiIePlQLyVmxumVRiKZlVJfmW7e0bZ9dGHX23JNu:4bhxsdVI012m5Y
TLSH 5EB423D245854A2ACC33297AB77E53AD42FB936C8442FC57D9C2CE1D49B2AEE2240D17
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 139.64.247.8
Sending IP: 139.64.247.8
From: Abdul Kazim <sales@percenna.com>
Subject: SFG Bilbo - Order
Attachment: Order List.rar (contains "Order List.exe")

AgentTesla SMTP exfil server:
smtp.listenerpro.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a306c1bf6ee9feec63bd333440b0b042bed171e614b969c67b1cf915f2586195/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 11:37:04 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=umdmdp3o5h7oyy55gm2ebmfqik7nc4pgcs4wtrt3dt4rl4symgkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a306c1bf6ee9feec63bd333440b0b042bed171e614b969c67b1cf915f2586195

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a306c1bf6ee9feec63bd333440b0b042bed171e614b969c67b1cf915f2586195

(this sample)

AgentTesla

Executable exe 3631b6f02663cc48d6ca8a8396a168c0d0204326c8d3ff66b25e013c7e8d5f93

  
Dropping
MD5 3ff28b1e5ec63b5413695e81f298a628
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3631b6f02663cc48d6ca8a8396a168c0d0204326c8d3ff66b25e013c7e8d5f93

Comments