MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 357eb66e6c8f01772b3c4d3c2f098ce01963c5ff2037ef20fabe385f45dbd107. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 357eb66e6c8f01772b3c4d3c2f098ce01963c5ff2037ef20fabe385f45dbd107
SHA3-384 hash: 5fd8293c4c9ea9a931a4d3000f6f580ba9c3e4032d24cad3964261d60f5048cdd9326cb348a6eae4797b926930be3483
SHA1 hash: 84ef7b3f1db2251f6e98cca9b34b93b47b51021d
MD5 hash: ceb164e5a0da7d40646c31b9cd1dfa21
humanhash: apart-connecticut-neptune-johnny
File name:Bank Slip.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:402'408 bytes
First seen:2020-07-06 09:07:39 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ZdMbchG8mFg+b/BkfiX1AIm+W9+DZKNFO0NuPj:Zdp4r/y4KOKNF5NQ
TLSH D184233A9BDAA11E12F4331B65ECF5786885FE51504318218DD98B9EF05E7360B883FE
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail1.rasandik.com
Sending IP: 203.115.96.50
From: thallyqa@rasandik.com
Subject: Fwd: BANK SLIP
Attachment: Bank Slip.rar (contains "Bank Slip.exe")

AgentTesla SMTP exfil server:
mail.bulletlogistics.in:26

AgentTesla SMTP exfil email address:
ccmncr@bulletlogistics.in

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/357eb66e6c8f01772b3c4d3c2f098ce01963c5ff2037ef20fabe385f45dbd107/
Threat name:
Win32.Trojan.DelfFareIt
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 09:09:04 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gv7lm3tmr4axokz4ju6c6cmm4amwhrp7ea366ih2xy4f6ro32edq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 357eb66e6c8f01772b3c4d3c2f098ce01963c5ff2037ef20fabe385f45dbd107

(this sample)

AgentTesla

Executable exe eaec22c2d23bb4d85d21b80ce1cc4b3874964631f615d1975cdab03467078f5b

  
Dropping
MD5 ba2351071bd8deee69319c1e3dec5d6c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eaec22c2d23bb4d85d21b80ce1cc4b3874964631f615d1975cdab03467078f5b

Comments