MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd3c4b1a98f1119f27af21ce01ec3ead75d2a8b94c4b9c7a3232459193fb5417. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd3c4b1a98f1119f27af21ce01ec3ead75d2a8b94c4b9c7a3232459193fb5417
SHA3-384 hash: c8ac9d5ef4f9a3c56daac062fba48d6ebdbc3411ff1fa14dc0fca57f86b6a36625a9d661da484ea6b20cc22f1e7bccec
SHA1 hash: 2555fe34522c498ad21d671e15d9a0b2775c20d3
MD5 hash: 4daf0904e1f6c11460a4e2f06c697a5e
humanhash: earth-bluebird-grey-zulu
File name:cpGoM9vVOEuBvfH.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:376'730 bytes
First seen:2020-05-04 22:04:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:yIWwsTCvyPFPvUFifqGJi4CGpDOv9NxmD6o6btJXyM1SkPPrslL5JtDC86nYf:yIWjaLFvGFfls9NzrlPPrslzT
TLSH 3F8423EF6278EAC3B026403EFE075A9E049197CFB84989D2C7B6D7750836364D5A25F0
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: combytellc.com
Sending IP: 37.49.230.28
From: Sandeep Gill <sandeepgill@combytellc.com>
Reply-To: Email ADMIN <noreply@domain-admin.com>
Subject: quotation
Attachment: cpGoM9vVOEuBvfH.rar (contains "cpGoM9vVOEuBvfH.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 22:36:43 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xu6ewguy6eiz6j5pehhad3b6vv25fkfzjrfzy6rsgjczde73kqlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar bd3c4b1a98f1119f27af21ce01ec3ead75d2a8b94c4b9c7a3232459193fb5417

(this sample)

AgentTesla

Executable exe 5a38c1770a9728871ebf9a8a4b7b9e676fe5ace9c9b4a1a5d64f8ae86044fa97

  
Dropping
MD5 e620cb9ccee4b0460a3af37e72e57a9f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5a38c1770a9728871ebf9a8a4b7b9e676fe5ace9c9b4a1a5d64f8ae86044fa97

Comments