MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d72d35adba8ec838c08352212252448854f69091a3a246b5fa7991ce649dbb01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d72d35adba8ec838c08352212252448854f69091a3a246b5fa7991ce649dbb01
SHA3-384 hash: da40247118370f7f0afe2dc14eef0932627ff7e2226bb262e66d00b08208d463edbb43668b61d5a32f925e53099964a1
SHA1 hash: 38790d82bbe3b79cc30a216118b2a5e75d82b4d6
MD5 hash: 32c35ae6c0fb7f30eebef3063f8cbed7
humanhash: oranges-mirror-fruit-november
File name:General Specification.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:760'369 bytes
First seen:2020-08-28 06:40:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:CajVBNu3VtVeb6Hgk/V08F7vmMAe2cqmqTfiCnZa+M17ZGoCcqPkkIT2SKo7Jof:CajTNulquh/VF7vmle2ciaqsj+oCcqPN
TLSH 4FF433C66083B8D4B489CD3C9904F78E4DE4FFB67DC69161E89150C922AD26FD0DB86D
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Delphine Low <Delphine_LOW@nyp.edu.sg>
Subject: Resend: Request for Quotation-ACP000252-HT(LMB-2)
Attachment: General Specification.rar (contains "General Specification.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d72d35adba8ec838c08352212252448854f69091a3a246b5fa7991ce649dbb01/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-28 06:42:06 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=24wtlln2r3edrqedkiqseuserbkpneeruorennp2pgi44ze5xmaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d72d35adba8ec838c08352212252448854f69091a3a246b5fa7991ce649dbb01

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d72d35adba8ec838c08352212252448854f69091a3a246b5fa7991ce649dbb01

(this sample)

AgentTesla

Executable exe 07ceaea9dd455538281cd8afd3b0fe49b34be3bfd7e30718572f6464bead5569

  
Dropping
MD5 e6201148b3a7026bf29818035359ec26
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 07ceaea9dd455538281cd8afd3b0fe49b34be3bfd7e30718572f6464bead5569

Comments