MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4ab6b4bc8e1563bf87af5492fb1b18939a575fe0d02a552a53a28865aa3f0a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4ab6b4bc8e1563bf87af5492fb1b18939a575fe0d02a552a53a28865aa3f0a9
SHA3-384 hash: 84326c3635da4f8094b8c1264e2b5927db474966c2e83c4e9c4ab7b1d169a3a7b66b3c9d4a7a25ea5262239c2a27a2b8
SHA1 hash: 700ab29ac7708de24b38a96788f7fe07b661db19
MD5 hash: 0fb1d2827c8e55c57bdcaed05fe7481b
humanhash: bulldog-neptune-violet-monkey
File name:SOA JUL.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:622'943 bytes
First seen:2020-08-10 07:18:09 UTC
Last seen:2020-08-11 19:54:44 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:1XCDExUheQ4cPSLBi+w2nZEzESfrO7MlJESUe+EDdtG1friYRDDNoRv:NCDp1wLBi+AxrZlJs5JoRv
TLSH FFD4237587B4AA886F86934C16E7EA706F49B13195EB50AFFD3247F3004E02C5863A73
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: qq.com
Sending IP: 103.99.1.172
From: "ZHONG HAO CARGO"<493137032@qq.com>
Subject: SOA FOR JUL.
Attachment: SOA JUL.rar (contains "SOA JUL..exe")

AgentTesla SMTP exfil server:
mail.varda.com.tr:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27121.RarHeur.NoDP.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4ab6b4bc8e1563bf87af5492fb1b18939a575fe0d02a552a53a28865aa3f0a9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 07:20:08 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2svwws6i4fldx6d26ves7mnrre42k5p6bubkkuvfhiuimwvd6cuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d4ab6b4bc8e1563bf87af5492fb1b18939a575fe0d02a552a53a28865aa3f0a9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d4ab6b4bc8e1563bf87af5492fb1b18939a575fe0d02a552a53a28865aa3f0a9

(this sample)

AgentTesla

Executable exe 7f09e1a23ce7b3b143221cd5f8be274e0b75380e6b3dd8e32d947c6f3b493104

  
Dropping
MD5 51cd9a94ff9c50f18ea55c3d4e844a41
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7f09e1a23ce7b3b143221cd5f8be274e0b75380e6b3dd8e32d947c6f3b493104

Comments