MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12044c14e75838d73382e1c2b29eb30d24df6c236a65dfdd738ff783fadbc8e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12044c14e75838d73382e1c2b29eb30d24df6c236a65dfdd738ff783fadbc8e9
SHA3-384 hash: 985ca2b341778d801809584c0824b32b5067ed7fd26affcc9a30d1f7dd31c74e4701203348940984ed5b1f4312b2325a
SHA1 hash: ab295bfc3b0145f9520a3a4ae10cb9d5628ac8a6
MD5 hash: 9a5363d329096a1100465ec40e4fe60c
humanhash: california-ack-river-mexico
File name:New Order pdf 7Z.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:428'538 bytes
First seen:2020-08-05 08:31:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:TnpuZYB67R+8A3wJUPeCOB0mdl9y8sRV4/twPQzTTgZuuHidhDIXlt/kFtZKnfhZ:TEZYx8ja5OBzJTT4HidhDIXlt/1foN7e
TLSH 5794237B183253BA0E8CEFAC6A0193413EFBA44531D13C5A922BC7BD67876C85D51E36
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bfcold.com
Sending IP: 23.106.223.209
From: Ling<beifeng@bfcold.com>
Subject: Request For New Order
Attachment: New Order pdf 7Z.rar (contains "New Order pdf.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27342.RarHeur.v5.HideExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12044c14e75838d73382e1c2b29eb30d24df6c236a65dfdd738ff783fadbc8e9/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:25:47 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ciceyfhhla4nom4c4hblfhvtbusn63bdnjs57xltr73yh6w3zduq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/12044c14e75838d73382e1c2b29eb30d24df6c236a65dfdd738ff783fadbc8e9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 12044c14e75838d73382e1c2b29eb30d24df6c236a65dfdd738ff783fadbc8e9

(this sample)

AgentTesla

Executable exe 712375dfdeacf96c7b08b655da383ebaa6843b012748c575fe310c8a3a33ccdd

  
Dropping
MD5 cec569f06f59952553854b6677247862
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 712375dfdeacf96c7b08b655da383ebaa6843b012748c575fe310c8a3a33ccdd

Comments