MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fedf30ece77fc867744683cd5bbf696d0d902d9961b0eca38896f0310e914526. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fedf30ece77fc867744683cd5bbf696d0d902d9961b0eca38896f0310e914526
SHA3-384 hash: 8ddd3e02c1192e82313cf9120245e9a0dc8228bc66b662166cf065f75630aceea6ee0bff342816e9796c636a15f7209a
SHA1 hash: 21f3c19417aa4d1f16ccf07de70812f2a2aa2708
MD5 hash: e7ae28af835c593dfacdf0a7376c6d1d
humanhash: skylark-nineteen-quiet-cat
File name:JEA_6789054.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:929'473 bytes
First seen:2020-06-18 06:21:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:xgvBsV8PDSPsyJlLoXWHz4LrXl+seRNU2O:xgdPmkjXWHz4L7l+serU9
TLSH 381533FBCFC68306C90D6143EDA5C03AC21555AB0B4AD3AC13A4719D1D667FBAABF211
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pdlc34160.ciberserver.com
Sending IP: 176.221.34.161
From: Marie Gracia <opr6.ae@absaco.com>
Subject: DELIVERY ORDER
Attachment: JEA_6789054.rar (contains "JEA_6789054.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 06:23:12 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=73ptb3hhp7ego5cgqpgvxp3jnugzalmzmgyozi4is3ydcduriuta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar fedf30ece77fc867744683cd5bbf696d0d902d9961b0eca38896f0310e914526

(this sample)

AgentTesla

Executable exe 77761e8530f70e653145a4736b03cc88abe3be089fbc2fec3eb294f4dc952377

  
Dropping
MD5 7cd324d4ea008f7c5bad83233a011418
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 77761e8530f70e653145a4736b03cc88abe3be089fbc2fec3eb294f4dc952377

Comments