MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf137f0692b646d11bb87c8c06ad015332a9c37edd4122991bfae62d16499f9d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf137f0692b646d11bb87c8c06ad015332a9c37edd4122991bfae62d16499f9d
SHA3-384 hash: 2464a1275cbaf521f12dc433036053c4af1acd718bdc603b8df26004d77c9a2595a9360cf4b7388ef54f760d4bdfbd46
SHA1 hash: 57dbc287762d2c7f226b8887fd9ed8bcc46f93af
MD5 hash: c6817b4020f57d6e3048735d52e9badb
humanhash: iowa-oxygen-alabama-lemon
File name:PO2207020.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:765'293 bytes
First seen:2020-07-22 09:26:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:4bM7lbyn6TV/2aPH8eqZ0jlgE5CQPgmHHxhHA9NB7nAz9aMOsi2ZXQpktwDOOv0w:4b2y6z8qhg5QPg+H0PB7M9am3M0IWm
TLSH AFF43303905757C781BC969C9CA492EBDF2CC119ACCEC06910D772703ADEADB2CEAC65
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.pt-gbi2.com
Sending IP: 202.93.228.123
From: yani_mi a. angel <yani_mi@pt-gbi2.com>
Subject: Order No. 406/22 of 22/07/2020
Attachment: PO2207020.rar (contains "PO#2207020 p2.bat")

AgentTesla SMTP exfil server:
mail.aylaalgan.com.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf137f0692b646d11bb87c8c06ad015332a9c37edd4122991bfae62d16499f9d/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 09:28:06 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x4jx6buswzdncg5ypsganlibkmzktq363vasfgi37ltc2fsjt6oq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bf137f0692b646d11bb87c8c06ad015332a9c37edd4122991bfae62d16499f9d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar bf137f0692b646d11bb87c8c06ad015332a9c37edd4122991bfae62d16499f9d

(this sample)

AgentTesla

Executable exe 8b54843b4acb823d224d090a1c2246860d643318959d95fa342b588fcba6a0c4

  
Dropping
MD5 3f3ffffb3df0dd6d10b540fd78f87e18
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8b54843b4acb823d224d090a1c2246860d643318959d95fa342b588fcba6a0c4

Comments