MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20b1ddb78fe23b024bf7d824cb12a71aab844b5d8e4c956c778b8606bcdbdc34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20b1ddb78fe23b024bf7d824cb12a71aab844b5d8e4c956c778b8606bcdbdc34
SHA3-384 hash: 2ff775b7d89cb368c56e8f144cb341d5edd41b62dc12079a293f4c8c9e8dc5c4b0453fae4326bd64bc6f5bc55de83d0a
SHA1 hash: 305e9a72daff480daf51a78b3c62107222a5a22f
MD5 hash: e655ff8b96cb654d570550ca2dff85be
humanhash: pip-ceiling-alanine-whiskey
File name:PDF45678234.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:564'851 bytes
First seen:2020-08-17 06:14:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:IMmuhhuYE35H7haLMsSVcb1mM/rCsvsdfk8e6X0yNWHZ9UigexTlsLJ6:lmuhJKVInSVk1m4nUkRu0yNk9TTlsd6
TLSH 29C423F25BC20AB2AA7FC163EFB42F15F10430510A74069E67CAE25115B63BD781AD6D
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: fedex.com
Sending IP: 193.142.59.10
From: Charlie MARQUETON <kendra.blair@fedex.com>
Subject: RFQ - Active Demand
Attachment: PDF45678234.rar (contains "PDF45678234.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20b1ddb78fe23b024bf7d824cb12a71aab844b5d8e4c956c778b8606bcdbdc34/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 06:16:08 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ecy53n4p4i5qes7x3asmwevhdkvyis25rzgjk3dxrodanpg33q2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/20b1ddb78fe23b024bf7d824cb12a71aab844b5d8e4c956c778b8606bcdbdc34

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 20b1ddb78fe23b024bf7d824cb12a71aab844b5d8e4c956c778b8606bcdbdc34

(this sample)

AgentTesla

Executable exe 5c0413285df419d479d3dff547aaeed3e6866566f7c84fdf2fbf583a8616df32

  
Dropping
MD5 6a0ea6a397d1f0a4c8f2cab9ea382e13
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5c0413285df419d479d3dff547aaeed3e6866566f7c84fdf2fbf583a8616df32

Comments