MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ced0916687b32fa4d3e9ef787972a74216926ad2abbe94e66d6a17b5161cfd7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ced0916687b32fa4d3e9ef787972a74216926ad2abbe94e66d6a17b5161cfd7a
SHA3-384 hash: 4f4b2c342c77aaea39c0ddbb12a05ffc5594f62dfb03858cb35d9c312ffcb9904f8bae3683404f216be1f37f4fc92159
SHA1 hash: 381eba12a03faff1138c5e642ff9bfa3cae1397a
MD5 hash: 3fc40c7265d9136f6b49070c95f91e80
humanhash: green-fifteen-hawaii-cola
File name:VLADEX RFQ EV24122019 INQUIRY_2020051__0019949030001,xlsx.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:373'191 bytes
First seen:2020-05-01 14:13:04 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:evtkzaXtR5y1vu68vd2MWYSS+ajYazyhVekLm6KSfDB6UZLU82TkolSIzC0UsV:pYtiZP86u+ajYaMVeky67fDBi82TblWO
TLSH 0E8423C9DAE4CD5FE04D3614E1AB8F5A661782F4C265E0CBA6A7F19F06786007FC90D2
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp.ostec-qroup.ru
Sending IP: 104.168.253.210
From: Danijel Stojanović <d.stojanovic@vladex.rs>
Reply-To: fosuji@yandex.com
Subject: VLADEX RFQ EV24122019 INQUIRY
Attachment: VLADEX RFQ EV24122019 INQUIRY_2020051__0019949030001,xlsx.r00 (contains "VLADEX RFQ EV24122019 INQUIRY_2020051__0019949030001,xlsx.exe")

AgentTesla SMTP exfil server:
mail.addd.org.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Suspected-exe-in-RAR.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-02 03:52:23 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z3ijczuhwmx2ju7j554hs4vhiilje2wsvo7jjztnnil3kfq47v5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 ced0916687b32fa4d3e9ef787972a74216926ad2abbe94e66d6a17b5161cfd7a

(this sample)

AgentTesla

Executable exe 3d11505113851303d2eccdbf69ae0e87f06eb0d6bc4170326ea5c0e02e61d589

  
Dropping
MD5 f15180ab6d5c70be3ed550509ce87c98
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3d11505113851303d2eccdbf69ae0e87f06eb0d6bc4170326ea5c0e02e61d589

Comments