MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d44b715fce1e924401dbb7f24b5c3496bd73e503344cddb9e90588986bc5de29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d44b715fce1e924401dbb7f24b5c3496bd73e503344cddb9e90588986bc5de29
SHA3-384 hash: 94d8ed5049fda391550b954511a89d414b5b00af6906f23b34e1d355deccc46614ed09db8dbb63b404420646e5dfb82e
SHA1 hash: 806d72c02992be178700de30fe0acf04f6822627
MD5 hash: cfd3aac2a3ea6222153d10110f081692
humanhash: quiet-colorado-don-orange
File name:RFQ_SCAN061020.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:516'220 bytes
First seen:2020-06-10 15:51:08 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:9lAHaQTtuW3nRT3S8ODqV3LppHCAb3Xl9+AzEgi:PA6WpneqlHtrhTi
TLSH 89B4237B0D082BC3DCED79B42D054D3321966538B001BE07FD16A96B99EBCB39437A66
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: total.tn
Sending IP: 192.227.246.82
From: Wassim BEN LAJNEF <Wassim.BENLAJNEF@total.tn>
Subject: Total Tunisia RFQ
Attachment: RFQ_SCAN061020.r00 (contains "RFQ_SCAN061020.exe")

AgentTesla SMTP exfil server:
mail.asplparts.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 15:53:05 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2rfxcx6od2jeiao3w7zewxbus26xhzidgrgn3opjawejq26f3yuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 d44b715fce1e924401dbb7f24b5c3496bd73e503344cddb9e90588986bc5de29

(this sample)

AgentTesla

Executable exe 205cd594827a0ed3b674ffb492157d3b99b7dab529ba8da44249b236558f67c4

  
Dropping
MD5 b20c00625ba48ebed836810bf8262b72
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 205cd594827a0ed3b674ffb492157d3b99b7dab529ba8da44249b236558f67c4

Comments