MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26821a62d7ceb91200ff8739f61c25d8c8a3b35835cd2f1d7f60793d698dabe2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26821a62d7ceb91200ff8739f61c25d8c8a3b35835cd2f1d7f60793d698dabe2
SHA3-384 hash: b79d9d247ca8e554bc9fd07cc87c244693f8a0c6719e12797f9a88a3d1e444989428b3cac632a56835c927232c7689ba
SHA1 hash: a15f6830b78ed7694d6df15f11dc5da015fd1045
MD5 hash: 50783125b957f74679a59f1377b250bf
humanhash: jupiter-green-florida-winner
File name:CTA-form, a proveedoresTFs.xls.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:434'954 bytes
First seen:2020-05-28 06:12:35 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:K/gaoeW7f6kBV3LVj2I6ml27vg0RSXCKMJag+Qcwqkx:K/gqW7f6kzpj2Ivl2bw/MJaJwqA
TLSH 719423AA1F13BFA50E7CE9730B51C20B0D8E6660A3E51FC67E4D48267D549748263CBB
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: WIN-799RI0TSTOF
Sending IP: 45.147.231.113
From: mgutierrex@vjcr.net
Subject: PAGO X TRANSFERENCIA-Cta Bco Alta relevancia
Attachment: CTA-form, a proveedoresTFs.xls.arj (contains "today crypt.exe")

AgentTesla SMTP exfil server:
smtp.ibemakine.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 06:36:39 UTC
File Type:
Binary (Archive)
Extracted files:
295
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 26821a62d7ceb91200ff8739f61c25d8c8a3b35835cd2f1d7f60793d698dabe2

(this sample)

AgentTesla

Executable exe 60b66b4e182a7c2510e2abecd821a0cb30de3da1309e01ed36230cc9bc556cac

  
Dropping
MD5 f8c65b22dafa13b9ff61743d6f71b1ca
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 60b66b4e182a7c2510e2abecd821a0cb30de3da1309e01ed36230cc9bc556cac

Comments