MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 217c94e83f4a74941f69fceaae7f8aa7613d52002daab8b593576c4a68e9c7af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 217c94e83f4a74941f69fceaae7f8aa7613d52002daab8b593576c4a68e9c7af
SHA3-384 hash: 11c36a3fd46e36d02ac3f993777960013f2f95953a4c1f5e91abf9b80321e7a38b6132fdaa65d8b07e8048dd75cfd16e
SHA1 hash: f2f2d3f02307245a6d9bd19c0371a6027d4a99e9
MD5 hash: 75ff1379d37df026e0ef75ce6eceeb52
humanhash: purple-nineteen-mars-asparagus
File name:PO. FSTG-20200030_SACANNED_DOC.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:264'608 bytes
First seen:2020-07-31 10:13:04 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:lyOl7K62NQs9BU8SBd/V+YFv301E1PHoaDeFmxEc9rNurDRDzf1z:17K62NQsQ8SB+Y5h1P/0kEcnurDJzl
TLSH 18442344A90EAD0005F377E5E50BAF4BA85139292E67BFA72754ED37613D93AF2084C3
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.genonop.cf
Sending IP: 133.130.110.81
From: Shinhwa Tech Co., Ltd. <admin@genonop.cf>
Subject: FW: PO. FSTG-20200030
Attachment: PO. FSTG-20200030_SACANNED_DOC.rar (contains "PO. FSTG-20200030_SACANNED_DOC.exe")

AgentTesla SMTP exfil server:
smtp.chigo-cec.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/217c94e83f4a74941f69fceaae7f8aa7613d52002daab8b593576c4a68e9c7af/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 23:15:50 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ef6jj2b7jj2jih3j7tvk474ku5qt2uqafwvlrnmtk5weu2hjy6xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/217c94e83f4a74941f69fceaae7f8aa7613d52002daab8b593576c4a68e9c7af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 217c94e83f4a74941f69fceaae7f8aa7613d52002daab8b593576c4a68e9c7af

(this sample)

AgentTesla

Executable exe c12845933b071eca81b78d24633ce54ea211cfedcdca167eb28cbf93572ebc1a

  
Dropping
MD5 c67e2d8e8a60cf1f14907fa6cea61a96
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c12845933b071eca81b78d24633ce54ea211cfedcdca167eb28cbf93572ebc1a

Comments