MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 217c94e83f4a74941f69fceaae7f8aa7613d52002daab8b593576c4a68e9c7af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 217c94e83f4a74941f69fceaae7f8aa7613d52002daab8b593576c4a68e9c7af
SHA3-384 hash: 11c36a3fd46e36d02ac3f993777960013f2f95953a4c1f5e91abf9b80321e7a38b6132fdaa65d8b07e8048dd75cfd16e
SHA1 hash: f2f2d3f02307245a6d9bd19c0371a6027d4a99e9
MD5 hash: 75ff1379d37df026e0ef75ce6eceeb52
humanhash: purple-nineteen-mars-asparagus
File name:PO. FSTG-20200030_SACANNED_DOC.rar
Download: download sample
Signature AgentTesla
File size:264'608 bytes
First seen:2020-07-31 10:13:04 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:lyOl7K62NQs9BU8SBd/V+YFv301E1PHoaDeFmxEc9rNurDRDzf1z:17K62NQsQ8SB+Y5h1P/0kEcnurDJzl
TLSH 18442344A90EAD0005F377E5E50BAF4BA85139292E67BFA72754ED37613D93AF2084C3
Reporter @abuse_ch
Tags:AgentTesla rar


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: mail.genonop.cf
Sending IP: 133.130.110.81
From: Shinhwa Tech Co., Ltd. <admin@genonop.cf>
Subject: FW: PO. FSTG-20200030
Attachment: PO. FSTG-20200030_SACANNED_DOC.rar (contains "PO. FSTG-20200030_SACANNED_DOC.exe")

AgentTesla SMTP exfil server:
smtp.chigo-cec.com:587

Intelligence


File Origin
# of uploads :
1
# of downloads :
28
Origin country :
US US
Mail intelligence
Geo location:
Global
Volume:
High
Vendor Threat Intelligence
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-07-30 23:15:50 UTC
AV detection:
17 of 48 (35.42%)
Threat level
  5/5
Threat name:
Kryptik
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 217c94e83f4a74941f69fceaae7f8aa7613d52002daab8b593576c4a68e9c7af

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments