MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74a3682b456c0755fccd537710fdfe01c9d268c3e59ed638c2b4d0c400e27d48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74a3682b456c0755fccd537710fdfe01c9d268c3e59ed638c2b4d0c400e27d48
SHA3-384 hash: 35822bdb31ecd7417ba7a86cd4d0f047157732ad524a870ba747073809d6a4fbb25e0c4042c9d499e20b8db17b0240cb
SHA1 hash: 70f7582f0508b475de81fdc5b9d22c4a90aaa5ed
MD5 hash: 088207ed871eddbd733f8b30b46527c7
humanhash: violet-april-charlie-quebec
File name:Payment Confirmation.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:498'257 bytes
First seen:2020-07-10 06:56:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:XXqUQ97RK1wNNesya4DZoC1f1Vn+4ERqXp8LXCiNo:XYRK1Z5aq2CdrnuRQE/y
TLSH 38B423ECF816F713D95E99110224A98DB3FBD1CCA365C56AC514BD228389FEE31325A3
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hanhen.com
Sending IP: 195.184.79.126
From: Kevin <Kevin@hanhen.com>
Reply-To: reply008363@hanhen.com
Subject: RE: Payment Confirmation
Attachment: Payment Confirmation.zip (contains "Payment Confirmation.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.Delf.FareIt.Gen.7.2197.30182.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22041.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/74a3682b456c0755fccd537710fdfe01c9d268c3e59ed638c2b4d0c400e27d48/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 06:58:07 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=osrwqk2fnqdvl7gnkn3rb7p6ahe5e2gd4wpnmogcwtimiahcpvea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 74a3682b456c0755fccd537710fdfe01c9d268c3e59ed638c2b4d0c400e27d48

(this sample)

AgentTesla

Executable exe 3cccff9a1654ffd65017b4264a450e2c1198275dd84050139794488778bd7961

  
Dropping
MD5 eab784731e9e99ee215c2741651d1b92
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3cccff9a1654ffd65017b4264a450e2c1198275dd84050139794488778bd7961

Comments