MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e275968cafdcfe406ad566a527940fbe31b6279e74360a40a7e4115daffb7f39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e275968cafdcfe406ad566a527940fbe31b6279e74360a40a7e4115daffb7f39
SHA3-384 hash: 3ea273d49b26814e309dc0248a91a6e093f75fdff3c627e89e9fcb16061e65fb1832a1d798574d96a0350a08a0cd990e
SHA1 hash: 0e32286a3b383fbfa3588d4c5ec4cc40f2814e6d
MD5 hash: 77ae8f4661b3a9e0423695556bdbc9eb
humanhash: equal-low-early-butter
File name:Order.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:304'932 bytes
First seen:2020-11-07 10:21:46 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:gxUKRDjrRn4f4KEENhXS8iSI8YKyrKEKBkaGd977S7LOAY1c5YtFaToECN5:+dR4f4KxfX2iYKsKEKiD7SeX4YtFH
TLSH 605422043F49D47969B305CE4D8EEF489DF69566A620AF0C599AEE31A9F087433C338C
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: rim-tele.com
Sending IP: 188.128.84.2
From: sula <suman.das@pernod-ricard.com>
Subject: RE: PAYMENT ADVISE..
Attachment: Order.r00 (contains "Order.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e275968cafdcfe406ad566a527940fbe31b6279e74360a40a7e4115daffb7f39/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 09:48:07 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4j2zndfp3t7ea2wvm2sspfapxyy3mj46oq3auqfh4qiv3l73p44q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 e275968cafdcfe406ad566a527940fbe31b6279e74360a40a7e4115daffb7f39

(this sample)

AgentTesla

Executable exe 38086b0c38d5b12436fc79d737a24e084a38b603ce36a2077965fdee5d0f9477

  
Dropping
MD5 4871e94132808b09092daa93311aba40
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 38086b0c38d5b12436fc79d737a24e084a38b603ce36a2077965fdee5d0f9477

Comments