MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2cbf4f9dd761354ed39ff023692e44cc9a25df8862bff88aebcd32b877d9f86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2cbf4f9dd761354ed39ff023692e44cc9a25df8862bff88aebcd32b877d9f86
SHA3-384 hash: dd6d8d1629126b5e5e3ec7d0fffb5ce92aa3e0afc901eb36753d30d7d2f49fbb93545567f42946abe006266bed2e0dc6
SHA1 hash: 7d9ee63f62b68ebd31720057690045ab2526499c
MD5 hash: 6b0f520b0f78b343f4c66cec385ce5da
humanhash: wisconsin-charlie-berlin-arkansas
File name:3D DRAWING AND PRODUCT SPECIFICATIONS P.ORDER 08297.bat.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:549'535 bytes
First seen:2020-08-03 15:07:03 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:DA73EN7Punu3Ns4xZDBh06iXHnnRX2tg0YBtU4GWXs1mWBMaBO:873ENB3NtDVqPXnl29qsvo
TLSH 38C423ABF86C9595647D7C09E0CEB1B258170805ACB604DBD61364BBFFE9FA07204BB1
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: SALES AND PURCHASE DEPT <gail.w@billzvision.us>
Subject: QUOTATION REQUEST OF PRODUCTS ATTACHED
Attachment: 3D DRAWING AND PRODUCT SPECIFICATIONS P.ORDER 08297.bat.rar (contains "3D DRAWING AND PRODUCT SPECIFICATIONS P.ORDER #08297.bat.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d2cbf4f9dd761354ed39ff023692e44cc9a25df8862bff88aebcd32b877d9f86/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 15:01:41 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2lf7j6o5oyjvj3jz74bdnexejte2expyqyv77cfoxtjsxb35t6da._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d2cbf4f9dd761354ed39ff023692e44cc9a25df8862bff88aebcd32b877d9f86

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d2cbf4f9dd761354ed39ff023692e44cc9a25df8862bff88aebcd32b877d9f86

(this sample)

AgentTesla

Executable exe c7ef577b1f4ed52125ba91adb3ae69578179afc6826b08acb7aa10641d8c2e96

  
Dropping
MD5 e251315450494f16faa55741b1e0a62e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c7ef577b1f4ed52125ba91adb3ae69578179afc6826b08acb7aa10641d8c2e96

Comments