MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae0f990ac79ae98e70a050cb2fe298a269f46974d9d6cb33f4138e8f693f309b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae0f990ac79ae98e70a050cb2fe298a269f46974d9d6cb33f4138e8f693f309b
SHA3-384 hash: 1c2f55b70b1cd40e314df5b5d3b7803a6df0a6f3358c797a9afa57805342f95f1c137ee516cc1ec1dd890cd70e4a413d
SHA1 hash: 75b3d23945ad362970969a77c6d12f23af1ab93a
MD5 hash: df0b860dd503ecd282fd5238f13ad8d0
humanhash: arizona-romeo-lemon-bulldog
File name:RFQ86437C.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:276'150 bytes
First seen:2020-08-03 06:56:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:stjV63Qyg69fxj47kab9tEmYqQl6BGc8WHXbUVdpQ8V3N+/V8Il7:CGZ9fxGtomYlk8dpniV3V
TLSH 884423C9AF5CCA54A932EE75C3596C16F7A921C07194F687CD62E8F27AF25067338013
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: kumbakarna.iixcp.rumahweb.com
Sending IP: 103.247.9.98
From: order03@ratorhu.xyz
Subject: New orders 1183978-B
Attachment: RFQ86437C.zip (contains "RFQ86437C.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ae0f990ac79ae98e70a050cb2fe298a269f46974d9d6cb33f4138e8f693f309b/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 06:58:14 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vyhzscwhtluy44fakdfs7yuyuju7i2lu3hlmwm7ucohi62j7gcnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ae0f990ac79ae98e70a050cb2fe298a269f46974d9d6cb33f4138e8f693f309b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ae0f990ac79ae98e70a050cb2fe298a269f46974d9d6cb33f4138e8f693f309b

(this sample)

AgentTesla

Executable exe 5fac93ed0fd840cedfc559b7f2285ad384004e78fd53178b09bef6b13db08b84

  
Dropping
MD5 bb177815728b49fd39053b643826b5cf
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5fac93ed0fd840cedfc559b7f2285ad384004e78fd53178b09bef6b13db08b84

Comments