MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 daac36c53cb80867d8bc28946d3f8cf7eab9021308f2bb874d6f56bfe6538ca7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: daac36c53cb80867d8bc28946d3f8cf7eab9021308f2bb874d6f56bfe6538ca7
SHA3-384 hash: a1f475b55b9101f28792f0b6747b621f126abd1ec3bc1df9cfb8a0235fd65e2f2a1afb3f99faae05fbc50d829e7e1f50
SHA1 hash: 3c0905b1fe9e7aad3d3536055eb11ead5411b5da
MD5 hash: d12dab8f01478e1147f3badb3adf25d5
humanhash: jupiter-washington-mars-golf
File name:Request for quotation, Order no 56774387.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:778'058 bytes
First seen:2020-06-04 06:21:22 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:k1zN8v67H3A9HcjXFayoo0gFzV8mWFcCGZ1pZoViVdK1zN8v67H3A9HcjXFayooS:k1JNT3A9HS8yooZzVNWFcCcLK1JNT3Aj
TLSH 07F42324D47C9D922E043747C2F9A2E75024C5C628600E5F9E2FDEAE728ED1BD93C676
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: arrow.com
Sending IP: 104.129.0.122
From: Daniel Teoh - Arrow Components <danielteoh.malaysia@arrow.com>
Reply-To: Daniel Teoh - Arrow Components <danielteoh.malaysia@arrow.com>
Subject: Request for quotation, Order no: 56774387
Attachment: Request for quotation, Order no 56774387.rar (contains "Request for quotation, Order no 56774387.exe")

AgentTesla SMTP exfil server:
mail.inventweld.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 02:19:20 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3kwdnrj4xaegpwf4fckg2p4m67vlsaqtbdzlxb2nn5ll7zstrstq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar daac36c53cb80867d8bc28946d3f8cf7eab9021308f2bb874d6f56bfe6538ca7

(this sample)

AgentTesla

Executable exe 7ec2b40879d6be8a8c6b6ba239d5ae547604ad2605de0d2501a4cca25915afa1

  
Dropping
MD5 f5b4045d0f6ca45b5fe859bae8f370d0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7ec2b40879d6be8a8c6b6ba239d5ae547604ad2605de0d2501a4cca25915afa1

Comments