MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2eeb435ccc3bf06383552e43ae93b683598611560bb3cbf19392fda51b3abb8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2eeb435ccc3bf06383552e43ae93b683598611560bb3cbf19392fda51b3abb8d
SHA3-384 hash: 28accf20017f54c2e10ff3d2b6880c6141165bf2de0bc8bceafc6e011e6f5505b69213c3e73e062dfe04e90a4ae50066
SHA1 hash: 4b4aa69cf26fb686985b2f65e39413bb08c71fa6
MD5 hash: ca45da483d6b4d974e684624b637b880
humanhash: sad-princess-bravo-foxtrot
File name:Revised Order.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:386'311 bytes
First seen:2020-06-16 12:57:55 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:z6G5MvF/idDbWmsBcAhF+6cfdkEN6llOkMd/ifBd+DviUg4E/9VFGxY5y8X/hMd4:zB5ai1bWZiAhFPq3NglBMd/ifSviUg48
TLSH 2384231B11CF77BC90294707D23C77CD8A2E9AF9245A3D7A54482DF08CB4B1A9D66CA3
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 162-241-215-159.unifiedlayer.com
Sending IP: 162.241.215.159
From: Mehvish Farheen <info@mosstolica.ru>
Subject: Revised Order
Attachment: Revised Order.7z (contains "Revised Order.exe")

AgentTesla SMTP exfil server:
mail.onouniforms.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 12:59:09 UTC
AV detection:
33 of 48 (68.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f3vugxgmhpygha2vfzb25e5wqnmymekwboz4x4mtsl62kgz2xogq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 2eeb435ccc3bf06383552e43ae93b683598611560bb3cbf19392fda51b3abb8d

(this sample)

AgentTesla

Executable exe 261333af2dd752293b60202b5737e95706ff6b206b1dec64c699b44147b0a797

  
Dropping
MD5 b5aab9198a6cac5901706f2860ffb84a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 261333af2dd752293b60202b5737e95706ff6b206b1dec64c699b44147b0a797

Comments