MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34a613de9fcaaeb5a7175845e9b3ff90ccada0f51820478ba55c211dde660ecf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34a613de9fcaaeb5a7175845e9b3ff90ccada0f51820478ba55c211dde660ecf
SHA3-384 hash: e37b23a4ade3ffdff0e7b25e37fdb2a0cf74eb4a8beeae6ee716434932a0018fc5d11f70586cea94d1e890576c9d3606
SHA1 hash: 55d1970eec69be757d74091694a51f6b74bf95d7
MD5 hash: 73439fb8036352a7041ee5e2158ec066
humanhash: bakerloo-neptune-saturn-romeo
File name:HN00057903.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'723'424 bytes
First seen:2020-06-29 07:48:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 49152:53vLaRMmzH/3YfMUgHTYUwekbvx2PJ3Zyf+Tcas:1WjzHvY8HTHsx6J3ZRI9
TLSH E4853328D8B76D3CAA54541A3335532B379F79F72676EBDCB3428982DA37046B099C20
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx1.africaonline.co.ke
Sending IP: 41.207.64.7
From: neeta@tlac.co.ke
Subject: Incoming Payment advice-BG_EDG7602020062601480045_423_760
Attachment: HN00057903.rar (contains "HN00057903.exe")

AgentTesla SMTP exfil server:
mail.edaraproperty.net:587

AgentTesla SMTP exfil email address:
wt.security@edaraproperty.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34a613de9fcaaeb5a7175845e9b3ff90ccada0f51820478ba55c211dde660ecf/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 07:50:07 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gstbhxu7zkxlljyxlbc6tm77sdgk3ihvdaqepc5flqqr3xtgb3hq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 34a613de9fcaaeb5a7175845e9b3ff90ccada0f51820478ba55c211dde660ecf

(this sample)

AgentTesla

Executable exe 7d7c564bbd04fdd7765b8f5d0ef8c1c21af8a247db06e9d02176dd2d60b5fd60

  
Dropping
MD5 59f2ea77d78642f1cf5cf4924615f7f4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7d7c564bbd04fdd7765b8f5d0ef8c1c21af8a247db06e9d02176dd2d60b5fd60

Comments