MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa819170383fc207d1f3da2d98396bf2d4f37268295450c1e8fcdfc1c25a88b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa819170383fc207d1f3da2d98396bf2d4f37268295450c1e8fcdfc1c25a88b8
SHA3-384 hash: 44c013b7329ba3799306721c84672a2ac9b2ab313fdc99a135caa2996ad5bdc28ca8a7dade9cba0ef92f78184f36cd18
SHA1 hash: 16bb3075ce6197786b7bf253f5ee760ac57bd046
MD5 hash: 2660269385f46ebfcda51cff6826fade
humanhash: arizona-victor-speaker-ohio
File name:Purchase Order DAWOOD PROJECT.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:374'395 bytes
First seen:2020-05-20 07:57:14 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:CohKs4HoCx9KUrXRNUZCMdGG0Z4oWhNXuFM4az4S6zg2R5/u1KqtVoLU:j4HoC9sGGD+bav6zF5/u1tVow
TLSH 148423CDC764BCC9248E870BA8562F451A3955A13ACEBD784F08EEB7D6FC9C46A27104
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 162-241-215-51.unifiedlayer.com
Sending IP: 162.241.215.51
From: Mohammed Mehroz <info@dawood.om>
Reply-To: Mohammed Mehroz <noblesdesks@gmail.com>
Subject: RE: Purchase Order DAWOOD PROJECT
Attachment: Purchase Order DAWOOD PROJECT.rar (contains "Purchase Order DAWOOD PROJECT.exe")

AgentTesla SMTP exfil server:
mail.oaslifting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 08:36:51 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vkazc4byh7bapupt3iwzqoll6lkpg4tiffkfbqpi7tp4dqs2rc4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar aa819170383fc207d1f3da2d98396bf2d4f37268295450c1e8fcdfc1c25a88b8

(this sample)

AgentTesla

Executable exe 2b215f12b5c2f2551558585ee9383431d50812c0b62f97c8c5f6b55a849dfdbd

  
Dropping
MD5 ad9e75028392cd40cee05fe30a193c21
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2b215f12b5c2f2551558585ee9383431d50812c0b62f97c8c5f6b55a849dfdbd

Comments