MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f397f6f793503f0ef89c31a98b3b66716ad62fb4841573bc535587357c075352. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f397f6f793503f0ef89c31a98b3b66716ad62fb4841573bc535587357c075352
SHA3-384 hash: 89dc1cdb01fe8c47686156eb722d04877fd6f6a5223a6c91de4641da04a2a1febabcb1abafb0e736f44fe0a7b1cf21d9
SHA1 hash: 676ae2248f2b4e8bc05356fb501d301a80ed1b57
MD5 hash: 16bc8bb4a46b46b584bfc6dff54c3c35
humanhash: nebraska-hawaii-lima-solar
File name:EDG95320200205005000471_126_953.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:318'547 bytes
First seen:2020-06-24 09:12:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Jx4hfATo1HX6i1/ACJmC8Yq9SBUuQaccNGiVwS7rpSFH5SuhZ8ttUA:JSATo1HXpAymJeQPNFS7CZ9sV
TLSH F1642308F0D6EBC59411395C591EA4B168E0F9E95D232B278CECD96ADF93F600B1AB60
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: topprogroupvn.pw
Sending IP: 142.11.216.250
From: CITI BANK <paylink.asia@citi.com>
Subject: Payment advice-BG_EDG95320200205005000471_126_953
Attachment: EDG95320200205005000471_126_953.pdf.zip (contains "EDG95320200205005000471_126_953.pdf.exe")

AgentTesla SMTP exfil server:
smtp.westcong.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f397f6f793503f0ef89c31a98b3b66716ad62fb4841573bc535587357c075352/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 09:14:05 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ol7n54tka7q56e4gguywo3gofvnml5uqqkxhpctkwdtk7ahknja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f397f6f793503f0ef89c31a98b3b66716ad62fb4841573bc535587357c075352

(this sample)

AgentTesla

Executable exe 0ec43ae5c8b1e95538f25ffe83123138a3d6083f5d9b2bdee312844689fa1f05

  
Dropping
MD5 aa93de5efb2b74972b3e8f9f5d185cd8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0ec43ae5c8b1e95538f25ffe83123138a3d6083f5d9b2bdee312844689fa1f05

Comments