MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81f8b562d18eae253a2ff78f0014528f9ad1ab7a9bc82bd9f1865950c34d4711. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81f8b562d18eae253a2ff78f0014528f9ad1ab7a9bc82bd9f1865950c34d4711
SHA3-384 hash: edf8be7ce735deab8a4399ebf215798ae97602888d34b3d69a3cef426d1ed519adc30598694bf9144fd7f6cd4b6585c6
SHA1 hash: 3353758022067f94563c9496d760f251753f4b3a
MD5 hash: f5d4e5fd3f03f689bd0ff839f6e99801
humanhash: lion-one-eight-oranges
File name:NEW INQUIRY LISTED ITEMS DATASHEET 20200725.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:382'596 bytes
First seen:2020-07-25 07:46:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:tgqaJSEVDI7jzrEKnu0qrC24ynIdnG3M9oDoCezxqoOveIla7WPEiQsXiyJLLCTU:fktVDGzrdnzqrCInlM74FvZIWMsXZxLN
TLSH BB8423FEB9B0CF5E9D0A76E21C4B901C5AD1BD6F9974785F42A2D02E10A33BBD446603
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cyber.net.pk
Sending IP: 103.149.13.242
From: TIONG PROCUREMENT DIRECTOR <centcorp@cyber.net.pk>
Subject: RE: Request quote_Eng Guan On [RFQ- EGHR20-0211734,EGHR20-0211724,EGHR20-0211735 & EGHR20-100324]
Attachment: NEW INQUIRY LISTED ITEMS DATASHEET 20200725.z (contains "NEW INQUIRY LISTED ITEMS DATASHEET 20200725.exe")

AgentTesla SMTP exfil server:
server126.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FXO54239BF7373F.236.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/81f8b562d18eae253a2ff78f0014528f9ad1ab7a9bc82bd9f1865950c34d4711/
Threat name:
ByteCode-MSIL.Spyware.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-25 07:48:06 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qh4lkywrr2xckorp66hqafcsr6nndk32tpecxwprqzmvbq2ni4iq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/81f8b562d18eae253a2ff78f0014528f9ad1ab7a9bc82bd9f1865950c34d4711

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 81f8b562d18eae253a2ff78f0014528f9ad1ab7a9bc82bd9f1865950c34d4711

(this sample)

AgentTesla

Executable exe c24a0d46cc2d07d42b8ea9546bfec76394fa4c8079d0ba223d093a023327c170

  
Dropping
MD5 54239bf7373fa5530090366b5f7e9ae4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c24a0d46cc2d07d42b8ea9546bfec76394fa4c8079d0ba223d093a023327c170

Comments