MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2015f19b00563d730c2df455e80099cd2c8f04fc396eac8908b5c59581cb0696. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2015f19b00563d730c2df455e80099cd2c8f04fc396eac8908b5c59581cb0696
SHA3-384 hash: 2512b269adb14faf6fd88a8bc7d4d97ad78410dae33cc25b4e1ab6e34f2a0a582da0a3e03108c7bb5fb4caf7c1ebbb15
SHA1 hash: 21fc89303553ee6e739e02fe91d47c3ee84a23d8
MD5 hash: 6eebdaf39a7289783f204f78399cbc8c
humanhash: five-eighteen-cold-earth
File name:New Order.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:495'449 bytes
First seen:2020-07-13 11:18:33 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:IeBt5RZ3r4FiZn5IvhqQYNXNX58E90boHZtBl5WO:HHZ3rpkVs58G0sRuO
TLSH 64B423EA6418FA6E3A398070BF771590BF50CB364BE47A7CA3CDBE99138300AD515746
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.zdravushka.by
Sending IP: 86.57.219.10
From: Sanda Kozinda <Sanda.Kozinda@nutricia.com>
Subject: New Order
Attachment: New Order.gz (contains "New Order.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2015f19b00563d730c2df455e80099cd2c8f04fc396eac8908b5c59581cb0696/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 11:20:11 UTC
AV detection:
17 of 27 (62.96%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eak7dgyaky6xgdbn6rk6qaezzuwi6bh4hfxkzciiwxczlaola2la._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 2015f19b00563d730c2df455e80099cd2c8f04fc396eac8908b5c59581cb0696

(this sample)

AgentTesla

Executable exe 94dc52733c22b1d6206cc50a5928387dda3a096256c69a8f84ee59b0f4367bac

  
Dropping
MD5 56319a742d0c0116f853e64ed1a8e1da
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 94dc52733c22b1d6206cc50a5928387dda3a096256c69a8f84ee59b0f4367bac

Comments