MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aea5b7e178a92202b0d90985583197949fd37144ffc0829d6616bd75b47540f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aea5b7e178a92202b0d90985583197949fd37144ffc0829d6616bd75b47540f7
SHA3-384 hash: 00242f5826b114aa6970863767d031bfd3c73afcbe7a0ae800ec69fb321603b688bf76bcf77360e1aa9f3837e769b970
SHA1 hash: e663188d05592d88716dcb215b59414ce29ef686
MD5 hash: 439f8a045e6139583719ce7557df233f
humanhash: paris-mobile-happy-solar
File name:OBL.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:362'230 bytes
First seen:2020-07-04 15:32:59 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Iv40XGQLQsnDzsAAZc+AEFMi6aDPzOmmj3L7KXqwN1Ge19O7yG/Y5lkRtno2Ecf7:P02QLLnDzCcsFM4DPJmj3L7KXhsA5lkZ
TLSH 507423A3B275F2922A4196FAB3FFC48DEB358DDD5D2982732D830342F4D662782102D5
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: srv1.demspor.com
Sending IP: 31.169.94.221
From: Export Dept <ravi.delhi@tg-india.com>
Subject: O.B/L Surrender Notice [B/L No : GINA05302700]
Attachment: OBL.rar (contains "OBL.scr")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aea5b7e178a92202b0d90985583197949fd37144ffc0829d6616bd75b47540f7/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-04 15:34:06 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v2s3pylyverafmgzbgcvqmmxssp5g4ke77aifhlgc26xlndvid3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar aea5b7e178a92202b0d90985583197949fd37144ffc0829d6616bd75b47540f7

(this sample)

AgentTesla

Executable exe 49e021e757dd9a8cabe9782e8d18de22ea5347f3cc180f02186ba66a77dcc055

  
Dropping
MD5 a0c3543faeb76d8a91fa62eb3465520b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 49e021e757dd9a8cabe9782e8d18de22ea5347f3cc180f02186ba66a77dcc055

Comments