MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa6a6d01e1863edc8d640fba369957a970bde274b6261e96e07af557afd80db3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa6a6d01e1863edc8d640fba369957a970bde274b6261e96e07af557afd80db3
SHA3-384 hash: f047be9cb0cb7c3ecc2e4400e9c0f748c6f5e96d9ec13f230eef3866e97a09920ef3b340e74b50b22bcd1906387f6464
SHA1 hash: efbf421d5c07a4461d391756e5cadb9937d4b255
MD5 hash: 3db940ce6ee50ae069c2859cc72e184e
humanhash: cold-august-fifteen-washington
File name:FACT.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:583'023 bytes
First seen:2020-08-18 19:29:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:xfMxaMbY2wyN9kAPczmGJz025fqF+sr4XOt0ReJ6NJMVk4OlfSfY:xkxq27NOGczmGJQ25f3sr4XOt0REkJsq
TLSH 5EC423D0C4990B6F8B572A5744228FB9BF8A8DD852C8CC8CFDBB4BB474A4261E45F075
Reporter abuse_ch
Tags:7z AgentTesla Yahoo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic304-56.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.128.31
From: Ivanet Neluta <ivanet_neluta@yahoo.com>
Subject: factura.
Attachment: FACT.7z (contains "FACT.exe")

AgentTesla SMTP exfil server:
bgisped.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa6a6d01e1863edc8d640fba369957a970bde274b6261e96e07af557afd80db3/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 19:31:07 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vjvg2apbqy7nzdleb65dngkxvfyl3ytuwytb5fxapl2vpl6ybwzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aa6a6d01e1863edc8d640fba369957a970bde274b6261e96e07af557afd80db3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip aa6a6d01e1863edc8d640fba369957a970bde274b6261e96e07af557afd80db3

(this sample)

AgentTesla

Executable exe b4d97e5fd7ec7fa2db1180417dbf4c4164e2d942c8a42388079b46bc5ab2f44c

  
Dropping
MD5 9b132b2baa4f3c7d3bb15b84d9e9608d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b4d97e5fd7ec7fa2db1180417dbf4c4164e2d942c8a42388079b46bc5ab2f44c

Comments