MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddf5e395143c2d42f408acc1a8a8a4f64aeacd39e051c0c368708a00ddd2a7fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ddf5e395143c2d42f408acc1a8a8a4f64aeacd39e051c0c368708a00ddd2a7fd
SHA3-384 hash: dba2c42b0f9bae73a45638569f9037b3c81cfee1487001897319c15bcc95298775277d782d449fd5ddea632b1f704bb8
SHA1 hash: 41c97509746d9e72ac46574eb8d05ecb8661321f
MD5 hash: 9fb1a254a74baaee3ae4494ae06426ef
humanhash: bluebird-seventeen-undress-sink
File name:New Order.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'254 bytes
First seen:2020-08-06 05:34:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:DF05BP9qNS+HFEu6wMMl14OCiLodMrofV0Z+cbpl40uCoQCdQIKV757TETfY:p05c5lEipn4bOxrc0cyHma975XEk
TLSH 6384236DF9E9D7B4D603136A7D4705B81C0E26E4116E4ABFCF0AF8DD7F1522009AA2B4
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.zsnh.cz
Sending IP: 85.163.0.58
From: Signmax Trading WLL <a.bougrine@agape-ma.com>
Reply-To: Re@zsnh.cz
Subject: RE:RE:RE:RFQ-20282011
Attachment: New Order.rar (contains "New Order.Scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ddf5e395143c2d42f408acc1a8a8a4f64aeacd39e051c0c368708a00ddd2a7fd/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 00:40:33 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3x26hfiuhqwuf5aivta2rkfe6zfovtjz4bi4bq3iocfabxosu76q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ddf5e395143c2d42f408acc1a8a8a4f64aeacd39e051c0c368708a00ddd2a7fd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ddf5e395143c2d42f408acc1a8a8a4f64aeacd39e051c0c368708a00ddd2a7fd

(this sample)

AgentTesla

Executable exe 2c65e0c23fc1e160821fc534bff9ea30e48c4a8af25cf2e3f5f03ec119627f7d

  
Dropping
MD5 53815c81256a5193a83600ddfc490298
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2c65e0c23fc1e160821fc534bff9ea30e48c4a8af25cf2e3f5f03ec119627f7d

Comments