MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21919255dfb2f1483f44346d5b6b8a7d504f11798a19f3728c37e5f115aa2fc9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21919255dfb2f1483f44346d5b6b8a7d504f11798a19f3728c37e5f115aa2fc9
SHA3-384 hash: a67862fbc316867a721426ad460bc643af9426df812263d727c07f056e4bca468dafad97f263b63abf2672136f561feb
SHA1 hash: 4523d3df6e6f79230bbad7145915e249e0d3e5cc
MD5 hash: d61e91a7561ab542006d4eb56431a51e
humanhash: oklahoma-uncle-ink-winner
File name:attachments.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:415'893 bytes
First seen:2020-06-14 13:27:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:MxG+US0yf107hkYgSu27CTuX0qkz3XFW29:47J0D7hkYa2LOzHFWO
TLSH 989423FD61041ABCFEB0A1E735F1714C5F11DA3A249218B41E12B1A5E1C6C2CBBAD26B
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: wahseong.com
Sending IP: 193.142.58.25
From: Andre scott <projectdirector@wahseong.com>
Reply-To: Andre scott<stavecrotts9618@mail.ru>
Subject: RFQ- Urgent Quotations Demand
Attachment: attachments.zip (contains "RFQ- Urgent Quotations Demand.exe")

AgentTesla SMTP exfil server:
premium71.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisF55C494D4A48.1797.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-14 13:29:07 UTC
AV detection:
31 of 47 (65.96%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=egizevo7wlyuqp2egrwvw24kpvie6elzrim7g4umg7s7cfnkf7eq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 21919255dfb2f1483f44346d5b6b8a7d504f11798a19f3728c37e5f115aa2fc9

(this sample)

AgentTesla

Executable exe 7dc5080e23dd65c77173e910f536b267a24479d61131a43c2c5104df5fb8405b

  
Dropping
MD5 f55c494d4a48e39ae3d69dfdd41ef5cb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7dc5080e23dd65c77173e910f536b267a24479d61131a43c2c5104df5fb8405b

Comments