MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae25aa2bf5adfbebd62e2949f955a830f3c66b189a15663855b5d0eb499febc9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae25aa2bf5adfbebd62e2949f955a830f3c66b189a15663855b5d0eb499febc9
SHA3-384 hash: 947321e6986ebe4fdd808bf73db1d0d31a3188c9040a7da7e3560bf08c676925520e7cdb2a1199d73cda55472a63c2da
SHA1 hash: f4a83013ebc0480cc8fcb13f90d4b91ebec9aa68
MD5 hash: 91a2f212bbd51a2ec3067a8dcd7101e2
humanhash: fanta-paris-nebraska-dakota
File name:Purchase Order No. 6095-SAP Ref. No. 587-MCS-19.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:413'960 bytes
First seen:2020-06-30 08:59:24 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:JBTjWK2xYM0rEGWPRB7nvTEGhD5bbFX9v:DjH2qyGcB7nIq7v
TLSH 5594236EE77A3B7505B31E021FCD8E58B31116CEF84756222A9C58E5269FDD10C28EEC
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vega.awedns.com
Sending IP: 101.99.77.52
From: Hit Computer - Terry <terryssw@hitcomputer.com.my>
Reply-To: Hit <nicolasdiegonicolas@gmail.com>
Subject: Purchase Order No. 6095-SAP (Ref. No. 587-MCS-19)
Attachment: Purchase Order No. 6095-SAP Ref. No. 587-MCS-19.GZ (contains "Purchase Order No. 6095-SAP (Ref. No. 587-MCS-19).exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ae25aa2bf5adfbebd62e2949f955a830f3c66b189a15663855b5d0eb499febc9/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 09:01:09 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vys2uk7vvx56xvroffe7svnigdz4m2yytikwmocvwxiowsm75peq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ae25aa2bf5adfbebd62e2949f955a830f3c66b189a15663855b5d0eb499febc9

(this sample)

AgentTesla

Executable exe 87f94a2fca72d8b4a2317257b3333d415ea4a9f28ac1470967f7b30e775030c2

  
Dropping
MD5 4c2b89f7f2367057d2b74c7cf3eccdd9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 87f94a2fca72d8b4a2317257b3333d415ea4a9f28ac1470967f7b30e775030c2

Comments