MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b03aac19f9b82760c6bfaae490f67806ae3ab405c78ff615d82aa9d2a1c69189. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b03aac19f9b82760c6bfaae490f67806ae3ab405c78ff615d82aa9d2a1c69189
SHA3-384 hash: b545d56eccab4ae74a9e8d2ce184130511724a346de145da687b159d2be8f6b6c3481f10052387138e894c2ff3edff32
SHA1 hash: 379af4af3b6da1fe29ffc16c969134ff6ae079de
MD5 hash: 1ebb439d831441421a66ecf8f35042ed
humanhash: echo-dakota-missouri-winner
File name:Quotation Bailey Trading.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:556'294 bytes
First seen:2020-08-03 13:18:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:4/vmjwujqZAeo7XQNH5hJmb7PTywAj9vyIc:4/usuyAe0AF5hJ4vKXc
TLSH 82C42300BA40A56E3FA1FC1CC7824781B42D43D471C792F697876F3E5E2679C536BAA8
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pmx.pla.net.py
Sending IP: 190.112.208.176
From: William <helaman@pla.net.py>
Reply-To: William <William@baileytradingcompany.com>
Subject: Looking For A Supplier One Year Contract-Purchase Order Bailey Trading
Attachment: Quotation Bailey Trading.rar (contains "Quotation Bailey Trading.exe")

AgentTesla SMTP exfil server:
mail.pierreinsurancebrokers.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b03aac19f9b82760c6bfaae490f67806ae3ab405c78ff615d82aa9d2a1c69189/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 13:20:14 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wa5kygpzxatwbrv7vlsjb5tya2xdvnafy6h7mfoyfku5fiogsgeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b03aac19f9b82760c6bfaae490f67806ae3ab405c78ff615d82aa9d2a1c69189

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar b03aac19f9b82760c6bfaae490f67806ae3ab405c78ff615d82aa9d2a1c69189

(this sample)

AgentTesla

Executable exe 4b1798ea1212bd8c50d111f5124660ca4c7288a1c11129aece16c279a11ab3b3

  
Dropping
MD5 2b2f4fc73af350d702be272d0359ae33
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4b1798ea1212bd8c50d111f5124660ca4c7288a1c11129aece16c279a11ab3b3

Comments