MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e73e148bc15e1a73efb0f8ded9b36de52c01e2e3f8586e4b7ac9d84d060a4880. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e73e148bc15e1a73efb0f8ded9b36de52c01e2e3f8586e4b7ac9d84d060a4880
SHA3-384 hash: f4a49db17ef214f7a2f0cbdf02967a64c8681f83e560fa501d4694cd96522541f1e3d4528355abb15af5f03cd9b6e82c
SHA1 hash: f6d29f570af7283c5852e29c7b845e1572898d27
MD5 hash: 78ed7a6d7a4345ef5d25cafd782e6ed4
humanhash: pizza-nine-oven-twelve
File name:Forwarding Agent 27-05-2020.xls.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'796 bytes
First seen:2020-05-27 08:02:12 UTC
Last seen:2020-05-27 13:03:25 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:eySkYFdSSheZNzxC5wKvyz8pOKf+YDYOJZ03Gx4PznS6rklLTPrOG/m9qM9Ds:ejkYjSNwKj4pOKTlQWq+6rklLrrx/5ss
TLSH F08423D24099694FECC80AF69EA105AC78F2017AF0B0BE7648F3A54E7D13DB97D5D910
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: oc-lines.com.cn
Sending IP: 209.58.149.65
From: Ada Wang<ada.opmngu@oc-lines.com.cn>
Subject: Forwarding Agent
Attachment: Forwarding Agent 27-05-2020.xls.rar (contains "Forwarding Agent 27-05-2020.xls.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 09:13:03 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
15 of 30 (50.00%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e73e148bc15e1a73efb0f8ded9b36de52c01e2e3f8586e4b7ac9d84d060a4880

(this sample)

AgentTesla

Executable exe e027dc8f6d9d8f468dc18e776bdf8eca3e8fabf45a4e4847b5835ca036bc1143

  
Dropping
MD5 bd22c94258ffe4384a167974e8b69c9f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e027dc8f6d9d8f468dc18e776bdf8eca3e8fabf45a4e4847b5835ca036bc1143

Comments