MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10226cd6bef93e092848b402a24dd7d3bd54472f57c91c4799b6ee11fe3ba70b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10226cd6bef93e092848b402a24dd7d3bd54472f57c91c4799b6ee11fe3ba70b
SHA3-384 hash: 273a12d8d6d740ee38949d99b23d22ed054e534d07f33f7269512bfad06983c276e2ef92f3797588d3aeb4d35159a625
SHA1 hash: 775919a088edbade3cd029ca70b1cd9a43e3fc9f
MD5 hash: be3f74182f7bd5ae70ac4a2981e1963b
humanhash: wisconsin-eleven-fillet-river
File name:Order_0720PDF.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:544'427 bytes
First seen:2020-07-06 15:02:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:6fFTaAs/kOv817vubhXwl2Z+/dLM5dR8zF5vyp9tyYQMsptVijA3:6BG81iXPZim5d2zF5vyzOQQ
TLSH A0C4236CD71DF673DC9454B2817E4B05BFA9823C90D16994A7C0D0EACA58CB1B8ACCF6
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns351952.ip-91-121-78.eu
Sending IP: 91.121.78.8
From: Tapani Koskimies <charlotte.perret@kemone.com>
Reply-To: worldnetofficemailer@gmail.com
Subject: VS: Поръчка 0720PDF
Attachment: Order_0720PDF.7z (contains "Order_0720PDF.exe")

AgentTesla FTP exfil server:
ftp.solarcenter.ro:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22887.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10226cd6bef93e092848b402a24dd7d3bd54472f57c91c4799b6ee11fe3ba70b/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 15:04:05 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cargzvv67e7askciwqbketox2o6virzpk7eryr4zw3xbd7r3u4fq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 10226cd6bef93e092848b402a24dd7d3bd54472f57c91c4799b6ee11fe3ba70b

(this sample)

AgentTesla

Executable exe 3fa8d147ff833b5f17193a61ea67be8ee5105af5b9059877f2f3feb965d5e679

  
Dropping
MD5 d0ebe8162fd3ed35301719781c6e5194
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3fa8d147ff833b5f17193a61ea67be8ee5105af5b9059877f2f3feb965d5e679

Comments