MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a738995be6c5b0a3d85bf164285232c397d38bc2025d238b4f633e7c3bcdab50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a738995be6c5b0a3d85bf164285232c397d38bc2025d238b4f633e7c3bcdab50
SHA3-384 hash: 4216745fef72fc73bb1ef345e899a10ba0851127d7d1cdcf30c3c7fef0f7fa5460bdb765a25da61dd47580cfac238d00
SHA1 hash: a8dc60980c4fa33aea243e775433878375178771
MD5 hash: 0005fb6a01714d1162c1e3a1d6916403
humanhash: july-nitrogen-wyoming-india
File name:890127762500.r09
Download: download sample
Signature AgentTesla
Create hunting rule
File size:598'130 bytes
First seen:2020-05-07 15:20:36 UTC
Last seen:Never
File type: r09
MIME type:application/x-rar
ssdeep 12288:u2o1x67F1wUvaK1a6YwMM0u/sNEOlxBnvakKLfJQ:uBGjwWd4wMML6FxBnvakKTJQ
TLSH 54D423CD0219EF4C739A2A8B510D14BF20D532B95309DD69B623B87AD46ED6EE0CC472
Reporter abuse_ch
Tags:AgentTesla r09


Avatar
abuse_ch
Malspam distributing AgentTesla:

Sending IP: 138.219.231.138
From: Martin Lopez <martinlp@idinamicas.com>
Subject: Re: QUOTATION
Attachment: 890127762500.r09 (contains "890127762500.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 15:36:04 UTC
File Type:
Binary (Archive)
Extracted files:
59
AV detection:
27 of 48 (56.25%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u44jsw7gywykhwc36fscqursyol5hc6cajoshc2pmm7hyo6nvnia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r09 a738995be6c5b0a3d85bf164285232c397d38bc2025d238b4f633e7c3bcdab50

(this sample)

AgentTesla

Executable exe dcc206d54d057142a23f0f00ca30ed924d4b293bbd1cce16f1ca4a946718892a

  
Dropping
MD5 2192bd011320b79fe8ea0176dff8b04d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dcc206d54d057142a23f0f00ca30ed924d4b293bbd1cce16f1ca4a946718892a

Comments