MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cb2478a1c9102a18a5d2e2cfc6ef22b784021d07b5b9cd7b8374f40eebdee15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1cb2478a1c9102a18a5d2e2cfc6ef22b784021d07b5b9cd7b8374f40eebdee15
SHA3-384 hash: eae4cce34edd3a6feee82b0f8361e8bac15607944ab881a11194670c96449c4b7ce5ceec5bdf53adc55f2b1c99172796
SHA1 hash: 792eb7ac2337c7d13689c565fb044c8441ac4eb7
MD5 hash: b0ab003ba64c94e13e3ef30949f32cef
humanhash: fourteen-north-ohio-cola
File name:Origenal Documents.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:487'271 bytes
First seen:2020-07-07 09:49:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Y4A0YTygNR5BhfP7l79s/ndfEEEQ+fbk3ZlaYS6IXttCU0:Y40mw7qndfELHQZGnXfCr
TLSH CEA4234169F0928F2F675213131B3588EDD13658AEF4EE99D42D81BBD22C76003BFE59
Reporter abuse_ch
Tags:AgentTesla DHL z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.ihszimbra24.com
Sending IP: 94.138.192.219
From: info <info@aymakoop.com.tr>
Subject: Re: DHL Shipping Documents
Attachment: Origenal Documents.z (contains "Origenal Documents.exe")

AgentTesla SMTP exfil server:
mail.elkat.com.my:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Daqc-6598201-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1cb2478a1c9102a18a5d2e2cfc6ef22b784021d07b5b9cd7b8374f40eebdee15/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 09:51:07 UTC
AV detection:
35 of 48 (72.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dszepcq4sebkdcs5fywpy3xsfn4eaioqpnnzzv5yg5hub3v55ykq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1cb2478a1c9102a18a5d2e2cfc6ef22b784021d07b5b9cd7b8374f40eebdee15

(this sample)

AgentTesla

Executable exe a6290ccc075d6f4d66eb6bdb5a1e36ef943eddeeead1460e9089564580f36271

  
Dropping
MD5 a769ece885ad74900b8828e28a53150c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a6290ccc075d6f4d66eb6bdb5a1e36ef943eddeeead1460e9089564580f36271

Comments