MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f7cb8aec860dd60449788695ac3d305cc416eb781010aa4af5624b28e9ad0d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f7cb8aec860dd60449788695ac3d305cc416eb781010aa4af5624b28e9ad0d0
SHA3-384 hash: a48aaa0c8d17a23b8ae9df853f8fc1e7d0dfcc1d2e887ea38173c24d7db92a492fc051cc0f2aed93d4739f2ceacf97b6
SHA1 hash: 742f73ea953d4a1f80a83fe9de52088d228c0e55
MD5 hash: 6e14e676b7194fdeb8a384007ff42385
humanhash: friend-louisiana-lion-lithium
File name:Transfer Copy-USD.PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:334'881 bytes
First seen:2020-05-28 06:39:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Dath+OXrkYhnOS26zYZx6eBU4r1WmAGE+uIZXwe2TOs0BNm0V0iDD8nBnUlPTjF:Dav++QYROg8Z9YpGVBXwe2uBkdiDDi9S
TLSH 9A64237A3FAE941877F1BD82C453930B473A8CD71C598082F090C2A6BB46CB5BFA55D9
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: qq.com
Sending IP: 183.3.226.186
From: Jennifer <jennifer@tanboergroup.com>
Subject: Transfer Copy-USD.PDF
Attachment: Transfer Copy-USD.PDF.rar (contains "Order_894993_list.doc.exe")

AgentTesla SMTP exfil server:
premium57.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27215.RarHeur.nocdb.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 07:36:35 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
14 of 31 (45.16%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 2f7cb8aec860dd60449788695ac3d305cc416eb781010aa4af5624b28e9ad0d0

(this sample)

AgentTesla

Executable exe 892f1145f83736f0b5c5d6e82843a920102f14f1923076785b3fa105c004a1ff

  
Dropping
MD5 d543179da8327c1de6a35110a54c7ec4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 892f1145f83736f0b5c5d6e82843a920102f14f1923076785b3fa105c004a1ff

Comments