MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 113287e47aa5311b71aeb97e0d26bd2d795070fde6db0d17887b4eab761849a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 113287e47aa5311b71aeb97e0d26bd2d795070fde6db0d17887b4eab761849a7
SHA3-384 hash: f3e5f08b89db3e858f8ce090c060f398a76fd300619022dae1efe76c6b2981a91f6420a11b0866be31ae5f08d28c94ab
SHA1 hash: e8b16cbdfd9c3bd4d7e5e505f0098264a582a00e
MD5 hash: 01471b799477059f0b7c3c364f09200b
humanhash: quebec-oklahoma-march-music
File name:Doc66202009475352576503.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:3'898'924 bytes
First seen:2020-08-06 05:25:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:BDFIJxvcbT6NoN4ErgC9RJGFg+CYJuxiYg+:BG7fix3Ag+CYJc
TLSH E706331E591D8A0233B229E7EC419B3B91738C446E11DFA3F5246AD85DF44C8E8E1F7A
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 2wed.w.serverhost.name
Sending IP: 80.209.230.62
From: Purchase Dept <purchase@arabico.ae>
Subject: URGENT QUOTATION - arabico company dubai
Attachment: Doc66202009475352576503.pdf.zip (contains "Doc#66202009475352576503.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/113287e47aa5311b71aeb97e0d26bd2d795070fde6db0d17887b4eab761849a7/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:27:06 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cezipzd2uuyrw4noxf7a2jv5fv4va4h543nq2f4ipnhkw5qyjgtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/113287e47aa5311b71aeb97e0d26bd2d795070fde6db0d17887b4eab761849a7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 113287e47aa5311b71aeb97e0d26bd2d795070fde6db0d17887b4eab761849a7

(this sample)

AgentTesla

Executable exe 2aa15fa44c566c42a45a262792c01f2badb64bbe49dc9abf38957bbebdbcf2d6

  
Dropping
MD5 b4edf20c8039d08d86bc7b4f7c98a91f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2aa15fa44c566c42a45a262792c01f2badb64bbe49dc9abf38957bbebdbcf2d6

Comments