MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc74a519b8fdd42268856f33107fbc5b0109d585f4a3581c89707c84de81e176. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bc74a519b8fdd42268856f33107fbc5b0109d585f4a3581c89707c84de81e176
SHA3-384 hash: eefb4fcbc2d2bb0ad1f028e968938cee57b81a99c018e5caebc9e82ff8699f52a35a375b8ab7d5a3dd25f996608067c9
SHA1 hash: 13631cf5cff4a4c7953aa9231b152454e247608b
MD5 hash: d417e8853eb0f31ed8109ebacc953b42
humanhash: sink-echo-football-sixteen
File name:Sample.Ref-834233.Scan..rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:354'919 bytes
First seen:2020-05-26 09:35:35 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Ysx7RYMKa1/BQ83rHbz4gMVRSqWHXuCyzGVesLt8/ibrYlUSDbB4f17xMWfati:LQspQU7z4fVRSqW3uCiwesxnyht671fH
TLSH AA7423F1D07E9D3AEE388120DEB4292BD11179B7D1D53F30126C0976B2C9E2AA61BCD5
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mono.avnam.net
Sending IP: 190.210.186.210
From: Sales <sales@bromma.com>
Subject: Current outstanding invoices
Attachment: Sample.Ref-834233.Scan..rar (contains "Sample.Ref-834233.Scan...exe")

AgentTesla SMTP exfil server:
mail.dehydratedoniongarlic.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27121.RarHeur.NoDP.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 10:36:57 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
15 of 48 (31.25%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar bc74a519b8fdd42268856f33107fbc5b0109d585f4a3581c89707c84de81e176

(this sample)

AgentTesla

Executable exe a4ee54e5cd44f0c532275bfae04a1cbcf0476a4201106349df4cb582e1cc359d

  
Dropping
MD5 2689bdffd0ff1c680cfd7d4a9dd22e97
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a4ee54e5cd44f0c532275bfae04a1cbcf0476a4201106349df4cb582e1cc359d

Comments