MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 224846953f7648d4d0f6d9a74e9df42c3cc7af6fa30f36219a0f6136e1778c39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 224846953f7648d4d0f6d9a74e9df42c3cc7af6fa30f36219a0f6136e1778c39
SHA3-384 hash: 01a1d65a13491651dd029886bc2002274c10b3c02a4fbbcfb37e172035a3df474055b203db26a0fff683fd1173cbd395
SHA1 hash: a74f3bd709f31296b128b6afa8b1b32c3d0356f1
MD5 hash: 6f078a0fbdffa0f55505fdff4658e0b2
humanhash: juliet-georgia-magnesium-triple
File name:REF17083887P.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'965'224 bytes
First seen:2020-07-21 14:08:01 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 49152:PBJiZQ5+lGhyfI5VqsJW9wjANjRm4NC9Gwe/LUQwtFGMENRWbIEpkCPDQBM6d:PBJx5+AhyA5jWwAJ8DGwO4/sRZOLYM4
TLSH 15D5335C98C067752A43E43DB9227683389AD6B2F8ABF53F6390323F1F4A4550587E87
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.megatroncorp.community
Sending IP: 162.241.205.158
From: birger.erstad@saint-gobain.com
Subject: REQUEST FOR QUOTATION
Attachment: REF17083887P.pdf.gz (contains "REF#17083887P.exe")

AgentTesla SMTP exfil server:
mail.hajartrading.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/224846953f7648d4d0f6d9a74e9df42c3cc7af6fa30f36219a0f6136e1778c39/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 14:09:08 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ejeenfj7ozenjuhw3gtu5hpufq6mpl3pumhtmim2b5qtnylxrq4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.66
Link:
https://yomi.yoroi.company/submissions/224846953f7648d4d0f6d9a74e9df42c3cc7af6fa30f36219a0f6136e1778c39

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 224846953f7648d4d0f6d9a74e9df42c3cc7af6fa30f36219a0f6136e1778c39

(this sample)

AgentTesla

Executable exe e0e1906cf3bdce3052f97a950aef614488f566a4d587428d64d0c848f97a7a4f

  
Dropping
MD5 e5cc05e9080d06724176fa9748c647e7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e0e1906cf3bdce3052f97a950aef614488f566a4d587428d64d0c848f97a7a4f

Comments