MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2a970a33ae1ee77d664c94c875a3f94d650f8bce30b8e1bb623b7d36c5ee9ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2a970a33ae1ee77d664c94c875a3f94d650f8bce30b8e1bb623b7d36c5ee9ae
SHA3-384 hash: c4094a33519ff0ccb23a2eab3416c430bbee78814bf3c83a4826b2a70e295945bc4d36c022140a2d5c45e40e286f1b6b
SHA1 hash: 13a9aadf00944b114873af15b584831beeae5ffe
MD5 hash: fecbc707f3c5835428f6840d3817f88c
humanhash: skylark-failed-salami-mars
File name:ORDER.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:352'460 bytes
First seen:2020-05-05 10:08:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:iPXjf6TUSRdhVovJyLVyI73Sft3t2aQeIjfvjQj0ymcbygpZUyk/ind:KXqdVVgSVbSft3YSILjQj0dg4o
TLSH 1E7423ECD7262E05ABC5F3B61A193731B13122DAC91B5198DEC827A931D3B9C15632EC
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.jati.su
Sending IP: 195.239.49.42
From: Young John <admin@metlife.ru>
Reply-To: abs000010@outlook.com
Subject: New Order
Attachment: ORDER.rar (contains "ORDER.exe")

AgentTesla SMTP exfil server:
ftp.cleanprolaundryparts.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 10:36:38 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
15 of 31 (48.39%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6kuxbiz24hxhpvtezfgiowr7stlfb6f44mfy4g5weo35g3c65gxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f2a970a33ae1ee77d664c94c875a3f94d650f8bce30b8e1bb623b7d36c5ee9ae

(this sample)

AgentTesla

Executable exe 10c15d9126c4bb34148ab6507cf2ed89a31b62dd394dbacb47718db3db50e47d

  
Dropping
MD5 a29d0ff0121a7fc63169c76ba9e16e2d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 10c15d9126c4bb34148ab6507cf2ed89a31b62dd394dbacb47718db3db50e47d

Comments