MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f54324caf492c862048a6fd72e56bf3a36f2b8b4e6f0dd74fe07d289b484039f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f54324caf492c862048a6fd72e56bf3a36f2b8b4e6f0dd74fe07d289b484039f
SHA3-384 hash: f24fe542d26c828ddaea55fa05310d4758892fdbbade3daa8b7ad6376cdcb57214edb4169eaf5f1b9b125d52fc8c0188
SHA1 hash: b53c2dc8255fa245f4ada73fda9c488a5daa4ec9
MD5 hash: b83efd22ede89e2f2aea10b0e889e2a2
humanhash: mountain-snake-lemon-autumn
File name:ORDER.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:426'961 bytes
First seen:2020-05-14 06:35:59 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:LgapEsoI+ootUs+F6ODA8ZKz9lrI9tEe8yInJV/8gCc8CZLKkuj233zcR2uNYDHi:LszISr+wOs8UzEt+J58JCZ+kSrtN4E9
TLSH C39423E20F0F3B97367917D0FB409989CD88A0F5F544E884D1B5367C88BA9AE13BA519
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vs-william2019.uk.syrahost.com
Sending IP: 176.74.30.2
From: KIM <scan@bestseller.cn>
Reply-To: abs0000100@hotmail.com
Subject: New Order
Attachment: ORDER.rar (contains "ORDER.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 07:37:08 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
18 of 48 (37.50%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6vbsjsxuslegebekn7ls4vv7hi3pfofu43yn25h6a7jitneeaopq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f54324caf492c862048a6fd72e56bf3a36f2b8b4e6f0dd74fe07d289b484039f

(this sample)

AgentTesla

Executable exe 6bece1991883897d6c949fa8eeac82f1bc6b7fbfaf581f5b5be776c4230bd007

  
Dropping
MD5 77559b96aa85d93521c6a495560752fa
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6bece1991883897d6c949fa8eeac82f1bc6b7fbfaf581f5b5be776c4230bd007

Comments