MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbc63974932e8afaea378f84e8e1b3c92dd58bfb214a7662a86a3655cec635fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbc63974932e8afaea378f84e8e1b3c92dd58bfb214a7662a86a3655cec635fb
SHA3-384 hash: 36942160893180d7685da3084d8cab204d2ef44540e7d90c191711dd6ee23e72e1c8f3b4e0eaaeb3728c0d5425fc2cd5
SHA1 hash: eb00bab771125a98213683a5efde4e957969324b
MD5 hash: 4540954199a5fa66b7a11c0f8817f1af
humanhash: rugby-orange-winter-island
File name:P.O RFQ Invoice.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:367'550 bytes
First seen:2020-06-25 07:51:35 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:jOZmg6TsC9qPoVbDQV3Xo96kNFUIZeGi9SuIDHAfRkiQebDFR1GMrrq9ZwC:qjF8mo5DQNXoIkN2IXi9SlDk9HFxMaC
TLSH 787423DF5C62AD625C9C7871DBF672C7C440EB2819E6A5277C61023AAED260CC1BC739
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.vipsan.com.tr
Sending IP: 213.142.130.160
From: info <info@vipsan.com.tr>
Subject: VİPSAN Ltd.Şti. P.O RFQ/Invoice
Attachment: P.O RFQ Invoice.rar (contains "P.O RFQ Invoice.exe")

AgentTesla SMTP exfil server:
smtp.woodmade.com.co:587

AgentTesla SMTP exfil email address:
patriciarobert7001@gmail.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27502.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fbc63974932e8afaea378f84e8e1b3c92dd58bfb214a7662a86a3655cec635fb/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7pdds5etf2fpv2rxr6coryntzew5lc73effhmyvini3fltwggx5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar fbc63974932e8afaea378f84e8e1b3c92dd58bfb214a7662a86a3655cec635fb

(this sample)

AgentTesla

Executable exe 83696b152ad0c65b1cdfbcdae66fda57a4cff3c20066e91c58d7d3e87854b6fa

  
Dropping
MD5 894f23134c3e8f996faaf2573797e679
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 83696b152ad0c65b1cdfbcdae66fda57a4cff3c20066e91c58d7d3e87854b6fa

Comments