MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fe0a11835ba8f747ff468e738353ac42b2a797ab99abfaa8d2a6e99acd82169. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2fe0a11835ba8f747ff468e738353ac42b2a797ab99abfaa8d2a6e99acd82169
SHA3-384 hash: 103dff1e65f24db24cf5a0d796fdaf9c729f396b283ddb3ebeb47a2d3173b8c20289542eb973290ecc7fbc478ece181a
SHA1 hash: 557902c751fd2274b8849411fe727cfc83c9ded8
MD5 hash: fd41e92694c1e6288d102ab8aa9edbc6
humanhash: alanine-winter-don-juliet
File name:Bank payment return x.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:691'539 bytes
First seen:2020-09-04 05:33:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:m3/Mn5at3yyGntrYj/8X+qai1zdHJugg8qHl7E4rPEf1Xs1hG1WCgV:+/GQ3DetrYT8XP/JgHJE4rPENc1MkDV
TLSH 44E4231651081D59FD61B4DE8FCCC0793CAF865BF09986C6B0567873CCB9FAA4892EE0
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email
From: Aseem Narang<aseem@ascomedical.com
Received: from ascomedical.com (unknown [103.133.106.246])
Date: 03 Sep 2020 21:26:53 -0700
Subject: Re: Return of bank payment TT / (Ref 018006 6743)
Attachment: Bank payment return x.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2fe0a11835ba8f747ff468e738353ac42b2a797ab99abfaa8d2a6e99acd82169/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-04 05:35:10 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f7qkcgbvxkhxi77undttqnj2yqvsu6l2xgnl7kunfjxjtlgyefuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2fe0a11835ba8f747ff468e738353ac42b2a797ab99abfaa8d2a6e99acd82169

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 2fe0a11835ba8f747ff468e738353ac42b2a797ab99abfaa8d2a6e99acd82169

(this sample)

AgentTesla

Executable exe 5da42c518ce35e02d03597851970d1fc15559cf1dc1463ff9239c1f178293886

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5da42c518ce35e02d03597851970d1fc15559cf1dc1463ff9239c1f178293886
  
Dropping
AgentTesla

Comments