MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f65ba326b60fd58d87436840db25081053f1d4d9ed32cc2a2c90f81149642941. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f65ba326b60fd58d87436840db25081053f1d4d9ed32cc2a2c90f81149642941
SHA3-384 hash: a195b91b9aac5bbf7183990d87198550d80ae5f6b5ab066485a9d91034242a1ea7038c7329b4ccb19f42b39efaa1a9a3
SHA1 hash: 307aae3b0d61e2080cf9571524d0c4241987590a
MD5 hash: 2cf04e15ae7a91a25df21f44e9922745
humanhash: sixteen-artist-music-bacon
File name:STATEMENT OF ACCOUNTS.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:386'689 bytes
First seen:2020-08-08 08:06:38 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:uXCw0qorDPCa+JXZNgQt/KsYgd85HRt5kQONjK7nJjfFnK0jFu3YBOqjN3sBo0J2:uXCw0bLX+JXZNHt/nYgd8vdOqnlfBK0V
TLSH 02842325E312AC20D7F5A22403144A8E6B67F3D2993751C319D58410ABA32FEBF5F9E7
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: kelsgroup.com
Sending IP: 185.222.57.156
From: Lordbrook Atwi<admin@kelsgroup.com>
Subject: 回覆: STATEMENT OF ACCOUNTS
Attachment: STATEMENT OF ACCOUNTS.rar (contains "STATEMENT OF ACCOUNTS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f65ba326b60fd58d87436840db25081053f1d4d9ed32cc2a2c90f81149642941/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-08 05:35:30 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6zn2gjvwb7ky3b2dnbanwjiicbj7dvgz5uzmykrmsd4bcsleffaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f65ba326b60fd58d87436840db25081053f1d4d9ed32cc2a2c90f81149642941

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f65ba326b60fd58d87436840db25081053f1d4d9ed32cc2a2c90f81149642941

(this sample)

AgentTesla

Executable exe d6fad316d9603cc8cf82b520043853ef4597124b2ffb86abf8b52b80e9f18a53

  
Dropping
MD5 e2b7db74c956abae98455820bca63323
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d6fad316d9603cc8cf82b520043853ef4597124b2ffb86abf8b52b80e9f18a53

Comments