MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4313df6bee4e6025934ff76ed2f7c8924b85f71b029060eede7f66d4b96eb027. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4313df6bee4e6025934ff76ed2f7c8924b85f71b029060eede7f66d4b96eb027
SHA3-384 hash: 910f9c057388baf1138b9d2f1d72b5bd642178b8aa9269566ecb8447fcbb40ad33884c37970ebf7fb759a30660556b2c
SHA1 hash: 11aeb44c9cc2f68ff24f02f90d0b5807ec1fc1f2
MD5 hash: 4ce44f37fc25f9392670b5d66a6c6ac8
humanhash: alabama-edward-emma-georgia
File name:RFQAMG223651.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:481'635 bytes
First seen:2020-08-18 19:38:52 UTC
Last seen:Never
File type: ace
MIME type:application/x-rar
ssdeep 12288:UioWMaHblGsY/vEi3D+3IX4bEGyODGbebFNPCp/VNq9C9OHM8P:Uiht7lrYXz3CYJZ6CyBMw
TLSH 88A423F3C5DCD6B0D8AB3560A51220B2B22256C6E32B33B242CFBE1D7195C1B651E5DB
Reporter abuse_ch
Tags:ace AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: serve0.tacadenaplc.pw
Sending IP: 104.168.253.8
From: Mikhailov V. <info@tacadenaplc.pw>
Reply-To: clausantiaqo95@gmail.com
Subject: RFQ#AMG223651
Attachment: RFQAMG223651.ace (contains "FRtsWDxBpc96ZPs.exe")

AgentTesla SMTP exfil server:
mail.sardaplywood.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4313df6bee4e6025934ff76ed2f7c8924b85f71b029060eede7f66d4b96eb027/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 09:03:05 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=imj5627ojzqcle2p65xnf56isjfyl5y3akigb3w6p5tnjolowatq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4313df6bee4e6025934ff76ed2f7c8924b85f71b029060eede7f66d4b96eb027

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace 4313df6bee4e6025934ff76ed2f7c8924b85f71b029060eede7f66d4b96eb027

(this sample)

AgentTesla

Executable exe 05568298144f10100f3882592a8be0a1754c579f581a3db6316d014c7f8ca8f3

  
Dropping
MD5 6fa5d1729bcb93c460bd3bb3ebf53eb4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 05568298144f10100f3882592a8be0a1754c579f581a3db6316d014c7f8ca8f3

Comments