MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50c050acb6ef365f0e6b76d9bb4d2e204833ae000bd15bf12402bf2e14f88081. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50c050acb6ef365f0e6b76d9bb4d2e204833ae000bd15bf12402bf2e14f88081
SHA3-384 hash: de43f5d539d4066f7140c8d7fa0a56cf728c3f1ab7c3f60b75427e643092e6aa7596d8c49d929767866def8fb68597f7
SHA1 hash: 0321cbc30612ebd2a79569b4913e01f9b1a12d47
MD5 hash: bbd01905115ac6fb2077d37abc62c81f
humanhash: helium-delta-orange-harry
File name:08710400.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:405'765 bytes
First seen:2020-06-25 17:10:42 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:EplKbImJWdDCDXCzHTuVWsHcdqRvwHZOynjQcE1BN4IylI4UmBw2/aX:EplVmJeDzHCBc0utnjQcE1BihrdwaaX
TLSH FA842332A6E8E19C5312BD238B869D9A4FF23FE4F1589582DB181F7325163D910F748B
Reporter abuse_ch
Tags:AgentTesla iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bp.com
Sending IP: 84.38.132.20
From: ALOROBA.Cont.Co. L.L.C<nworkspace.exchange27e8ecg8ozu4182019@bp.com>
Subject: W-YX-4758757498DOC
Attachment: 08710400.iso (contains "08710400.exe")

AgentTesla SMTP exfil server:
mail.jerrypiwq.website:587

AgentTesla SMTP exfil email address:
infos@jerrypiwq.website

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/50c050acb6ef365f0e6b76d9bb4d2e204833ae000bd15bf12402bf2e14f88081/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 17:12:05 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kdafblfw543f6dtlo3m3wtjoebedhlqabpivx4jeak7s4fhyqcaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 50c050acb6ef365f0e6b76d9bb4d2e204833ae000bd15bf12402bf2e14f88081

(this sample)

AgentTesla

Executable exe cfbf1e8483cddd75356dedc9630659fca435a94c522c43c9178c1114aa6423b3

  
Dropping
MD5 1f477a4b1819887662b205cf5784b46b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cfbf1e8483cddd75356dedc9630659fca435a94c522c43c9178c1114aa6423b3

Comments