MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 855263f7ed041f5da038670064102952fb42ac68fb0efc35e1d9fef3c6cfbead. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 855263f7ed041f5da038670064102952fb42ac68fb0efc35e1d9fef3c6cfbead
SHA3-384 hash: feda02333400b57d8577f2016b466fcd5b1ac5e26a4da81760c6658c1cbde30fcc5f099aacfde152edd779536a4cb29d
SHA1 hash: 82a30f0d22f3f902d7e99b0cc96126c076ea2234
MD5 hash: 37d1e9608644114725f61b9612323b75
humanhash: uranus-virginia-failed-dakota
File name:Refno07312020.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:407'323 bytes
First seen:2020-08-05 06:52:51 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:E/CC6RojFJNz5EvfllJ4a9ndFvt0/8f4EivpHiz5:SkoRJcJ4Yrvt0gCg5
TLSH AE842342846759FB5215749C0B3892DAE6B760FFF25F06E18B4C0EF7E2B893074D285A
Reporter abuse_ch
Tags:AgentTesla ESP geo gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: metzerplas.com.ec
Sending IP: 185.222.57.165
From: metzerplas-ecuador@metzerplas.com.ec
Subject: Re: DEVOLUCIÓN DE PAGO TT (Ref no07312020)
Attachment: Refno07312020.gz (contains "Refno07312020.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/855263f7ed041f5da038670064102952fb42ac68fb0efc35e1d9fef3c6cfbead/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 06:54:06 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qvjgh57naqpv3ibym4agiebjkl5ufldi7mhpynpb3h7phrwpx2wq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/855263f7ed041f5da038670064102952fb42ac68fb0efc35e1d9fef3c6cfbead

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 855263f7ed041f5da038670064102952fb42ac68fb0efc35e1d9fef3c6cfbead

(this sample)

AgentTesla

Executable exe 652c0bdfcb3143e7e53653a820dcf1a3528afb60a09ae7817ef20e6094d97596

  
Dropping
MD5 234a825d2eff8cbb96042dbe414d20cb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 652c0bdfcb3143e7e53653a820dcf1a3528afb60a09ae7817ef20e6094d97596

Comments