MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 289ebd22d7506f6d3fe8f263509456f5d4056d6df43e76dbfe0ed78cf0da0a1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 289ebd22d7506f6d3fe8f263509456f5d4056d6df43e76dbfe0ed78cf0da0a1c
SHA3-384 hash: 23e78a49fb441369d1d0ae0b51a52f9133034b0f40253c2e9ca3e7bb6afdb4fc1fbef4cbeee8e4a195fa5099d3960fa7
SHA1 hash: 6b4fdb6ce30cae4e23952cfac2845aaddb8872b2
MD5 hash: dc3298bc40cbacfbfa39f1e9917be833
humanhash: paris-carolina-queen-nebraska
File name:shipping documents.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:662'455 bytes
First seen:2020-08-04 13:30:35 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:EeypI/EXX/YIbbldcW2cc3ITeV0V2zVmgYaIF74C9/EGkly:f/En/YIbbH2BzVm2IFJEa
TLSH 18E423FB3EA4090653E74AA1657CE47AD8D641F3B1A0A20F5621DDEF96B0938FE31D00
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Monica moor <Monica.moor@vishalshipping.com>
Reply-To: Monica.moor@vishalshipping.com
Subject: Shipping Documents
Attachment: shipping documents.rar (contains "shipping documents.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/289ebd22d7506f6d3fe8f263509456f5d4056d6df43e76dbfe0ed78cf0da0a1c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 13:32:09 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fcpl2iwxkbxw2p7i6jrvbfcw6xkak3ln6q7hnw76b3lyz4g2bioa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/289ebd22d7506f6d3fe8f263509456f5d4056d6df43e76dbfe0ed78cf0da0a1c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 289ebd22d7506f6d3fe8f263509456f5d4056d6df43e76dbfe0ed78cf0da0a1c

(this sample)

AgentTesla

Executable exe 28a9ceab6ce4f00161170c5b1eda918bf572357b4e27644f07b897e8866a0b4a

  
Dropping
MD5 47717aee9349ea9b2c22454353cc06d9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 28a9ceab6ce4f00161170c5b1eda918bf572357b4e27644f07b897e8866a0b4a

Comments