MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb48c5969a99555d9a72ba1427fb5959ea696cb6ba7857b42671d555141b3959. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb48c5969a99555d9a72ba1427fb5959ea696cb6ba7857b42671d555141b3959
SHA3-384 hash: 815155ff0f420f11875b979a77b87217a65fd1f56603eb0de874ee721741fd1c5214beeb8a62da936f6421570d0abeeb
SHA1 hash: c5d014c14bb47ae233514edf051c6fc794165276
MD5 hash: 5bf584fecd24c42f858e4411fc329652
humanhash: venus-nevada-leopard-red
File name:Quote 1-2.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:560'054 bytes
First seen:2020-08-03 17:43:01 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:joyWC2Vwo0jT7LbLJLsrZLZSP7YJ/Jxh6pWhUC9SqeqjpfBTX6v:c5wpnbLJIrZLk+gwb3pm
TLSH 97C4230ABA96BA8F5E89826968530CB5DD0AFF5E03AD464144D907DEDBC770F8374307
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: scorpio.atomiclayer.com
Sending IP: 96.125.179.170
From: (Sales Manager) Alexios Eliyah <Alexios@takowa.com>
Reply-To: evanesultanedeseba@gmail.com
Subject: Please confirm Quote # 1-2
Attachment: Quote 1-2.rar (contains "Quote 1-2#.exe")

AgentTesla SMTP exfil server:
webmail.volivesolutions.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb48c5969a99555d9a72ba1427fb5959ea696cb6ba7857b42671d555141b3959/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 17:44:08 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7nemlfu2tfkv3gtsxikcp62zlhvgs3fwxj4fpnbgohkvkfa3hfmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fb48c5969a99555d9a72ba1427fb5959ea696cb6ba7857b42671d555141b3959

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar fb48c5969a99555d9a72ba1427fb5959ea696cb6ba7857b42671d555141b3959

(this sample)

AgentTesla

Executable exe 32c2766ee799eeffcfdff37dc5a1237b1c152f36b7108c4bd13c082db2d46423

  
Dropping
MD5 75a63e23c47d23198061e6b11d317f39
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 32c2766ee799eeffcfdff37dc5a1237b1c152f36b7108c4bd13c082db2d46423

Comments