MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12357ac84471fd0739b175b0affa3eca7e85644dda13ad70db251085792bdf90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12357ac84471fd0739b175b0affa3eca7e85644dda13ad70db251085792bdf90
SHA3-384 hash: 9aa7e08cd708724fbfea3df080ee23cc7510c7dac12ab071cff25a3a1199ab2d05989529a034b32a25609116ddf08168
SHA1 hash: 8bd1bcf98986e36908ef43db8ddf82c7f4481213
MD5 hash: 31fc245e5b92deb0355c5265de9de2de
humanhash: harry-vermont-single-lamp
File name:RFQ_Scan P.List Offer.r01
Download: download sample
Signature AgentTesla
Create hunting rule
File size:418'762 bytes
First seen:2020-07-08 05:08:00 UTC
Last seen:2020-07-08 06:38:54 UTC
File type: r01
MIME type:application/x-rar
ssdeep 12288:hMRAmXp/W1OtAexNetJgsd6eoC8N/KyxvtGXZ:2GmZ/W1ohul6pN/KyrGXZ
TLSH A194236F996808C1263BEAF95FFA36399D633C3A8CDCD03F606B5A1014CE90295E75C5
Reporter cocaman
Tags:AgentTesla r01


Avatar
cocaman
Malicious email
From: inoxebel@yahoo.co.uk
Received: from antyca.vservers.es (antyca.vservers.es [91.142.220.128])
Date: Wed, 08 Jul 2020 06:53:44 +0100
Subject: PURCHASE ORDER
Attachment: PURCHASE ORDER.r01

Intelligence

File Origin
# of uploads :
2
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12357ac84471fd0739b175b0affa3eca7e85644dda13ad70db251085792bdf90/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 01:59:00 UTC
File Type:
Binary (Archive)
Extracted files:
45
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ci2xvsceoh6qoonrowyk76r6zj7ikzcn3ij224g3euiik6jl36ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 12357ac84471fd0739b175b0affa3eca7e85644dda13ad70db251085792bdf90

(this sample)

AgentTesla

Executable exe 8eb3933e2012364a81fa9f1003c485c03c6cafd61eefaf1b4059cc8d4a4066a7

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8eb3933e2012364a81fa9f1003c485c03c6cafd61eefaf1b4059cc8d4a4066a7
  
Dropping
AgentTesla

Comments