MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbe5335b17080653b9914a9088f3cacaf9e962a14739ed3e938ac46ed16dda02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbe5335b17080653b9914a9088f3cacaf9e962a14739ed3e938ac46ed16dda02
SHA3-384 hash: 957dda2130a00c8ee7aeb30b86559bfc9decda1ee59ea6367569d8f0b10bd3499d5ed258c1c5cb98a5a4db1fef6fa2da
SHA1 hash: 972804ae9c499f8f3f9d45902069a3ede0359d92
MD5 hash: aa5fa2440c3be8a77f2c0577eb2bad09
humanhash: eighteen-michigan-low-sweet
File name:Doc_Sample Order.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:420'431 bytes
First seen:2020-08-05 14:00:08 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:f8k/Ct3lY86J0X1p7rkSADNxMUksY6KsCgamrV0cLGueAI4F09s:Uht3l36J0lxrkXw6xCgao4uer4ey
TLSH 409423CFF03811CE1EA67A0C997B5216B9002FD645F5C4AF0CA9A75CBBC62F2107597A
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: debbieltd.pw
Sending IP: 104.168.143.233
From: Mario<info@debbieltd.pw>
Subject: Product Sample order
Attachment: Doc_Sample Order.rar (contains "JXQPHd6B7KarWaN.exe")

AgentTesla SMTP exfil server:
mail.pkstyles.pk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fbe5335b17080653b9914a9088f3cacaf9e962a14739ed3e938ac46ed16dda02/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 14:02:07 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7pstgwyxbadfhomrjkiir46kzl46syvbi4462putrlcg5uln3iba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fbe5335b17080653b9914a9088f3cacaf9e962a14739ed3e938ac46ed16dda02

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar fbe5335b17080653b9914a9088f3cacaf9e962a14739ed3e938ac46ed16dda02

(this sample)

AgentTesla

Executable exe 202f16849e4ced52d2d65f28b81b2b1b348fbca42f44351e649429845c7f8946

  
Dropping
MD5 250dbf0fad18e5515073646021f8edd3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 202f16849e4ced52d2d65f28b81b2b1b348fbca42f44351e649429845c7f8946

Comments