MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8ac68862fad9fcf7dd8a2ed546a17c2315a74ad40b7f73e18e2566dc29cd637. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8ac68862fad9fcf7dd8a2ed546a17c2315a74ad40b7f73e18e2566dc29cd637
SHA3-384 hash: ded9b4b048838a7b1381ed0924194deef9fbf12d9f6ab9d5ed21fb589a83254995ca055a60a9ad13043150f87426e4bc
SHA1 hash: f0084adea2acfa876b4e36c7ee5cfae0c6d1dff4
MD5 hash: 0093dc3079b6ba7568cf8f59afc3cac3
humanhash: leopard-alabama-mirror-low
File name:RFQ nº6200134210.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:425'691 bytes
First seen:2020-06-24 05:37:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:H/IFgr9UpxWxQytBr8NXr7jSFH2PlThAYgSAf1fpt+le6geVhdMGJZBqBAHSt1w:QFgpUpxWxQcQ7fTpgJf1Rt0gChd98CyI
TLSH BA942357C6DAEBC1748862C5B33AE1BDA0590F8CE07B543A295B3B6CD22049B390F45F
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: m97141.mail.qiye.163.com
Sending IP: 220.181.97.141
From: Gavin <gavin@pampering-pet.com>
Subject: AW: Urgent inquiry – UT / 06. 24, 20 (SZS)
Attachment: RFQ nº6200134210.rar (contains "RFQ nº6200134210.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8ac68862fad9fcf7dd8a2ed546a17c2315a74ad40b7f73e18e2566dc29cd637/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 05:39:05 UTC
AV detection:
15 of 30 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5cwgrbrpvwp467oyulwvi2qxyiyvu5fnic37opqy4jlg3qu42y3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e8ac68862fad9fcf7dd8a2ed546a17c2315a74ad40b7f73e18e2566dc29cd637

(this sample)

AgentTesla

Executable exe a9316a887a00dbf992833394b7a4e05db6e6e6929f66419a06ebbccf358e45b4

  
Dropping
MD5 6ece2e8f7890352dd190713fb6e21eb9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a9316a887a00dbf992833394b7a4e05db6e6e6929f66419a06ebbccf358e45b4

Comments