MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fecb83fb62d6b20b3a5fd98580c98356e0c7001fcc3332dd97b85cce8895fb8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fecb83fb62d6b20b3a5fd98580c98356e0c7001fcc3332dd97b85cce8895fb8c
SHA3-384 hash: 3780cc9f0d605c9c8a2dcb1c655fe49ce3ec6ccb2dbfab8a487a3190656bfeaf114ef5e53606101c86366776ff9119a1
SHA1 hash: 7dd4b385b818396eeb0f81c1c51d9d2b4b414419
MD5 hash: bada70bb7eaef2963a2ad75b0ab4031f
humanhash: equal-orange-cola-sweet
File name:Quotation-PDF.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:658'024 bytes
First seen:2020-08-18 08:43:08 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:s+ELZZP1BZqkzAuoaxPMV5EoaCFdy6TlvFBTaXyjIFTQdwH:svf1B0kfx0EWjy6TZ7TaXyE9Qde
TLSH F2E433354C3A79F8760F320B5A69FC1325EC5EB3D74361FD4605C799C989E0B88A8BA1
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gicoronado.hpservidor.com
Sending IP: 65.175.68.101
From: ABM Industries<linda.zara@yorkstell.com <linda.zara@yorkstell.com>
Subject: #534 y #535 NECESARIO URGENTEMENTE
Attachment: Quotation-PDF.rar (contains "Cy4ACxDCeCe2E9s.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fecb83fb62d6b20b3a5fd98580c98356e0c7001fcc3332dd97b85cce8895fb8c/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 08:45:07 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=73fyh63c22zawos73gcybsmdk3qmoaa7zqztfxmxxbom5cev7oga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar fecb83fb62d6b20b3a5fd98580c98356e0c7001fcc3332dd97b85cce8895fb8c

(this sample)

AgentTesla

Executable exe 292653b32a47a61bce313dae00ecc4c3dd5c34f21a12a8baf73aad832886b750

  
Dropping
MD5 181160e5690b91c8e2f2a2456384f814
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 292653b32a47a61bce313dae00ecc4c3dd5c34f21a12a8baf73aad832886b750

Comments