MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b88f390ef31894cf7d3a1667480af733ac738d8c5b76f0821dc2ce073f754eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b88f390ef31894cf7d3a1667480af733ac738d8c5b76f0821dc2ce073f754eb
SHA3-384 hash: c4e2475f7f8e846631bafa2b2fbfba90577a3eb4df74c4a0f45e9a84b21cba2202f84153f8951ba1d5100a753836b424
SHA1 hash: d57f0823d1c26b55464adedb115392007f8970ec
MD5 hash: ba97e89ec056044bdddc9b9ad3bda23d
humanhash: venus-snake-arizona-artist
File name:Payment Slip.r11
Download: download sample
Signature AgentTesla
Create hunting rule
File size:498'551 bytes
First seen:2020-07-13 06:35:06 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Q43mvynITlalSZnW9wGkUQUj3GMwQ0/VmOFDPKc6DtcAkfT:Q43mLTCSlW94UQNMwQdK6yAA
TLSH 40B42355CB91DD7DDE925FB8E1D6CB687A39217C17CBB7522ABE3E208C429C048B40E4
Reporter abuse_ch
Tags:AgentTesla Endurance r11


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 142-4-22-49.unifiedlayer.com
Sending IP: 142.4.22.49
From: Account Chun <chun.winglandshipping@bk.ru>
Reply-To: Account Chun <chun.winglandshipping@bk.ru>
Subject: RE: Payment Slip -OrdER June
Attachment: Payment Slip.r11 (contains "Payment Slip.exe")

AgentTesla SMTP exfil server:
smtp.desmaindian.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b88f390ef31894cf7d3a1667480af733ac738d8c5b76f0821dc2ce073f754eb/
Threat name:
Win32.Trojan.DelfFareIt
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 06:37:04 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=doephehpggeuz56tufthjafpom5moogyyw3w6cbb3qwoa47xktvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 1b88f390ef31894cf7d3a1667480af733ac738d8c5b76f0821dc2ce073f754eb

(this sample)

AgentTesla

Executable exe 0e231e55790532d2097e3ebe446aa7faf319dafe60f48bd12431c6e2ccb80eaa

  
Dropping
MD5 660f8c58cc4dc37f7e989f962e321073
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0e231e55790532d2097e3ebe446aa7faf319dafe60f48bd12431c6e2ccb80eaa

Comments