MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecdaec3f875a9c5c7226fa62ab6d71dc2f9d46d2ffef6acf6f4c32f11445c3bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ecdaec3f875a9c5c7226fa62ab6d71dc2f9d46d2ffef6acf6f4c32f11445c3bf
SHA3-384 hash: e4ef4392fdd54960ba816ba463d608c1c14ff47c15fd4d8614f266845b9008ed5b7ac7e6e20639fb9562fd7dacffb24e
SHA1 hash: 0f2d32a604bed489acf360deaff7ed0c89e5359a
MD5 hash: 2479a80fbb01a94913991213d29bb89d
humanhash: wisconsin-oregon-moon-sodium
File name:sar file2020.r10
Download: download sample
Signature AgentTesla
Create hunting rule
File size:403'703 bytes
First seen:2020-06-03 11:19:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Qd+UI+wtX0fdILOgXJe0mBCWY05Kbj/6iqw6ZQ:QUUlaRXg3Q3/FcQ
TLSH 5384237285847AF0B387A5B6645DF165CF34F60AC9A6EE366C84BE4CDE80D508E0F6C4
Reporter abuse_ch
Tags:AgentTesla r10


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: fluxless.duckdns.org
Sending IP: 185.181.9.158
From: noreply@sars.gov.za
Subject: SARS eFiling Letter Notification
Attachment: sar file2020.r10 (contains "sar file2020.exe")

AgentTesla SMTP exfil server:
zstcznz.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 11:38:05 UTC
File Type:
Binary (Archive)
Extracted files:
295
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5tnoyp4hlkofy4rg7jrkw3lr3qxz2rws77xwvt3pjqzpcfcfyo7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ecdaec3f875a9c5c7226fa62ab6d71dc2f9d46d2ffef6acf6f4c32f11445c3bf

(this sample)

AgentTesla

Executable exe d5ce91227aaf02cc3c883cf2a078ecbb60c164bdcc6ec6da3c14f3a7a919f611

  
Dropping
MD5 a1283e298587b674393016e746da57b4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d5ce91227aaf02cc3c883cf2a078ecbb60c164bdcc6ec6da3c14f3a7a919f611

Comments