MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 facbfd321ddec999d2d4aee72ca223cb8d5e7f0d233beb04bbffa347b621124c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: facbfd321ddec999d2d4aee72ca223cb8d5e7f0d233beb04bbffa347b621124c
SHA3-384 hash: fb7fa076215236f2a460cc2beb4666f86d6a18d5e771fe3d0da81e086f6c6838a792f7d78e6915f7fe5dd97f8bf81f7d
SHA1 hash: 0da48bd271890c2e23537ae64371d5b536eb2dcc
MD5 hash: 4801a0d6d7162e1ee5e620ec5f9edb8c
humanhash: july-cold-green-jersey
File name:invoice2647467565683746597475859575.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:386'884 bytes
First seen:2020-06-24 06:43:14 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:MnlQ8vCtYdRjfLV86XT5zykrTCE2iCdIZ9FRdJDsPnNmOR9Xd67ez:MnlQTt6RzxR5zb+lIZ9FRL8mOjd678
TLSH E98423DB7941138A3C726769EC55EAF852F07CF9185EB35F31982B0BE5064E30A72E42
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ptmatsuo.co.id
Sending IP: 202.74.72.84
From: Elisa Stefanica <Elisa.stefania@gmail.com>
Subject: Payment Schedule
Attachment: invoice2647467565683746597475859575.gz (contains "invoice2647467565683746597475859575.exe")

AgentTesla FTP exfil server:
ftp.southeating.com:21

AgentTesla FTP user name:
aceboss@southeating.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/facbfd321ddec999d2d4aee72ca223cb8d5e7f0d233beb04bbffa347b621124c/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 06:45:05 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7lf72mq533eztuwuv3tszirdzogv47ynem56wbf376rupnrbcjga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz facbfd321ddec999d2d4aee72ca223cb8d5e7f0d233beb04bbffa347b621124c

(this sample)

AgentTesla

Executable exe e71a7b0188810d7b205a33023bb27c064cc442a1478a15a85f9feb653693f50b

  
Dropping
MD5 0d86043fa1d2aa8e4cd3349adc2bcc61
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e71a7b0188810d7b205a33023bb27c064cc442a1478a15a85f9feb653693f50b

Comments