MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfcaee2142e1dab0a1bf550e41a67eda34516e9ca6fd3fd6ce1addf5eea13883. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bfcaee2142e1dab0a1bf550e41a67eda34516e9ca6fd3fd6ce1addf5eea13883
SHA3-384 hash: acf6c91b77338528cad7ca14cddb90f6343fcff82195f3f765b01f96dd28778d23d98cfb5615b518ddb6fdff7ed36f5f
SHA1 hash: 9e55ea0d89af00a7640650087a368d0280ad1242
MD5 hash: b561ff62c6e19a47549dd44796e51ef0
humanhash: kitten-apart-charlie-arizona
File name:packinglist.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:462'874 bytes
First seen:2020-08-17 13:57:25 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:sjG54Qw/Rhk7uemzXBwNcX39RXsPtW5aDbKn4xhL0ySP4c:sq57wDkiRj8S39RktNw4xhL0ymV
TLSH 09A423E51B7393C2B14F82C372BB3B946BE67A07785516CE99F0E8D0C212B51346CB88
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: svr.kinden.co.id
Sending IP: 202.169.44.104
From: Laura Wang <info.vincolinwilliam1@yahoo.com>
Reply-To: info.vincolinwilliam1@yahoo.com
Subject: SHIPPING DOCS 200703
Attachment: packinglist.rar (contains "packinglist.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bfcaee2142e1dab0a1bf550e41a67eda34516e9ca6fd3fd6ce1addf5eea13883/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 13:59:06 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x7fo4ikc4hnlbin7kuhedjt63i2fc3u4u36t7vwodlo7l3vbhcbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bfcaee2142e1dab0a1bf550e41a67eda34516e9ca6fd3fd6ce1addf5eea13883

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar bfcaee2142e1dab0a1bf550e41a67eda34516e9ca6fd3fd6ce1addf5eea13883

(this sample)

AgentTesla

Executable exe 7abdc63d0ff763f8caa5ff80afbc8480f56566858304afa832c7123357ab6b54

  
Dropping
MD5 f72e0b68300ff3747ad7141d200bf2da
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7abdc63d0ff763f8caa5ff80afbc8480f56566858304afa832c7123357ab6b54

Comments