MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9cee62616753e96bdcc3f9138462089f8e1f43bc7937ff7288e98c5980e2453. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9cee62616753e96bdcc3f9138462089f8e1f43bc7937ff7288e98c5980e2453
SHA3-384 hash: 7f5dc41120af32c0dcc97aab9c7f67aa78418bba3f6524732ba21276b899d3f2df7c0282febb32c25aceb9a3628eca1a
SHA1 hash: 39c17f15129531c72118936210c621d101424442
MD5 hash: 01286a3107168625edd316f65d075475
humanhash: eighteen-arizona-artist-bravo
File name:Order List_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:221'024 bytes
First seen:2020-06-30 13:30:18 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:UIiI3M3aDiBjvvZ9TcSUqHcYFo5ylXf2kU68BY6znpAEDycoAQeD8+o2:U+3MqQR94qTFZffD6pA3coAJo2
TLSH F324237E56D28C1382D8E5DFAEB9FFF34CF5BB07860E44C128AF64088066461A16F61D
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mcegress-7-lw-150.correio.biz
Sending IP: 191.252.7.150
From: Charlotte Butler <smtpfox-f8a35@pontaldolagoflat.com.br>
Subject: Re: Charlotte Butler Inquiry
Attachment: Order List_pdf.rar (contains "Order List_pdf.exe")

AgentTesla SMTP exfil server:
smtp.sknei.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f9cee62616753e96bdcc3f9138462089f8e1f43bc7937ff7288e98c5980e2453/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 13:32:04 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7hhomjqwou7jnpomh6itqrrarh4od5b3y6jx75zir2mmlgaoerjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f9cee62616753e96bdcc3f9138462089f8e1f43bc7937ff7288e98c5980e2453

(this sample)

AgentTesla

Executable exe 08c1f9f0755e45b664ec5cd4e5e44b895e204cd89c91fc59e5a218af5abc5779

  
Dropping
MD5 d402cd3dabdfbae88e6a5cb67acb00ef
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 08c1f9f0755e45b664ec5cd4e5e44b895e204cd89c91fc59e5a218af5abc5779

Comments