MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1224712c748f40bed496b240fc7b7f27e0377a1e9e3ba418df1bde7b51ce88b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1224712c748f40bed496b240fc7b7f27e0377a1e9e3ba418df1bde7b51ce88b0
SHA3-384 hash: 542f266cd06c13d8a36da5ade3dcfec2478f2129ea70cdda810b1bf3ecfd9f4302d6df7d0f0add7f0a4bb30811219ec1
SHA1 hash: 214dcfaf886cba4c31c03949ba9125c9a05942b6
MD5 hash: 7aa1728f649457b47fcfa89d5c576fd9
humanhash: jupiter-kansas-oxygen-single
File name:The details for your perusal.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:398'682 bytes
First seen:2020-06-29 07:52:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:riHZNf97vKBv4Yb2JkdymZpjGUNPqsHNO24QK8:r0fpvKBAYCDCjtRH
TLSH D8842314965948BBCEC775AE87264DF953100EEB985D90A160300AC87F3B3BBEDDD84E
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: valorem.com.sv
Sending IP: 45.90.222.94
From: Santosh Shukla<todosolar@valorem.com.sv>
Subject: the details for your perusal
Attachment: The details for your perusal.zip (contains "The details for your perusal.exe")

AgentTesla SMTP exfil server:
smtp.net4india.com:587

AgentTesla SMTP exfil email address:
zz@royale.net.in

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ENGK.190.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1224712c748f40bed496b240fc7b7f27e0377a1e9e3ba418df1bde7b51ce88b0/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 07:54:10 UTC
AV detection:
30 of 47 (63.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cishcldur5al5vewwjapy637e7qdo6q6ty52igg7dpphwuoorcya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1224712c748f40bed496b240fc7b7f27e0377a1e9e3ba418df1bde7b51ce88b0

(this sample)

AgentTesla

Executable exe cb48dbab14d829d20075958b99f179cd774fcb41d105b28d3fac54dbe80639bb

  
Dropping
MD5 4b99c5611817ec938b0075dfd8c94e4e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cb48dbab14d829d20075958b99f179cd774fcb41d105b28d3fac54dbe80639bb

Comments