MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a994f13e4545be47e4ffb9c89b420ee3af818cb2e0d2dceca24b83057a3755ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a994f13e4545be47e4ffb9c89b420ee3af818cb2e0d2dceca24b83057a3755ae
SHA3-384 hash: e4fedabf075cd42959d8092c9914a9e9e8a355813fcc744e7b06a918e34b27d49f6ce0d2e77afd0db9b0bde529504fc1
SHA1 hash: 5ed67bf871296ae4c31b6196f21c5c623779090a
MD5 hash: 5bcca8c1eaac00320829fde21694a580
humanhash: asparagus-hot-batman-tango
File name:Kosser Order.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:645'143 bytes
First seen:2020-08-31 10:28:37 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:o3GNWiioOyJBTbFqheOrspIyQeGobw2d/1JeXUNPBy/3ZuLKi7evJ:GGN+gSxyfPG12hmqPc/3ZuOiKvJ
TLSH 29D4231F0188133ED97F653ADDAD6C6C35340E263AE2FA4C21777B9E15F4B5288684AC
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ew0.704.maxzizo.ml
Sending IP: 167.71.206.34
From: KOSSER JSC <office@koser.com>
Subject: New Koser Order #2020240
Attachment: Kosser Order.r00 (contains "Kosser Order.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a994f13e4545be47e4ffb9c89b420ee3af818cb2e0d2dceca24b83057a3755ae/
Threat name:
Win32.Trojan.Crypt
Create hunting rule
Status:
Suspicious
First seen:
2020-08-31 03:14:02 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vgkpcpsfiw7epzh7xhejwqqo4oxyddfs4djnz3fcjobqk6rxkwxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a994f13e4545be47e4ffb9c89b420ee3af818cb2e0d2dceca24b83057a3755ae

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 a994f13e4545be47e4ffb9c89b420ee3af818cb2e0d2dceca24b83057a3755ae

(this sample)

AgentTesla

Executable exe 566cc49c88933b9cbc164bf023f658f63c5befb6510c7c0e8c2b355f5f351803

  
Dropping
MD5 219cef9161906de506e56e03ad365bd0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 566cc49c88933b9cbc164bf023f658f63c5befb6510c7c0e8c2b355f5f351803

Comments