MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0286eb89e11b10ec16c273dc2b7de65e805d5480473d5d9510af52067dfb5af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0286eb89e11b10ec16c273dc2b7de65e805d5480473d5d9510af52067dfb5af
SHA3-384 hash: 3844da9087eda601726b4d990c16d616b5229b6583f6201ebed17c69c60b2883a220bff7304c7fcc0f0eb7625ec567df
SHA1 hash: c5d51b02222f7d4f3494bc404bdb114978967bc7
MD5 hash: bff4a262ee2708814931aa5365c01bfc
humanhash: autumn-lima-asparagus-connecticut
File name:Verify Email.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:403'065 bytes
First seen:2020-12-24 09:23:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:gG7RYmkXKDKbyYEtiu4Ri2O3sGlIZO57bEVm3PC+KhZegWq5:gmRPwKbYEEuii2qaZy7Km3PhKhZegD5
TLSH A3842350D3D2B6FE64C46DA61C4BBED405DFDFF70B8277884A2011A8EA2844DAE6835D
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: victim-domain
Sending IP: 37.48.85.240
From: victim-domain IT <it-department@victim-domain>
Subject: ACTION REQUIRED IN YOUR MAILBOX!! (Storage Full) to victim-email
Attachment: Verify Email.rar (contains "Verify Email.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
767
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.2714.1552.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c0286eb89e11b10ec16c273dc2b7de65e805d5480473d5d9510af52067dfb5af/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-12-24 09:24:05 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yaug5oe6cgyq5qlme464fn66mxualvkiarz5lwkrbl2saz67wwxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c0286eb89e11b10ec16c273dc2b7de65e805d5480473d5d9510af52067dfb5af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c0286eb89e11b10ec16c273dc2b7de65e805d5480473d5d9510af52067dfb5af

(this sample)

AgentTesla

Executable exe 6116ef2b4b628a4f3ded1e531f7a08a62310d2d0644979d301c03836fe33ab1f

  
Dropping
MD5 9d5fc75809aa9b02e943f194adfaee95
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6116ef2b4b628a4f3ded1e531f7a08a62310d2d0644979d301c03836fe33ab1f

Comments