MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f4f6eb511e3968c7473d795f816224ce53bdaff081d87e8399e6efdcab42173. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f4f6eb511e3968c7473d795f816224ce53bdaff081d87e8399e6efdcab42173
SHA3-384 hash: 91d397f305c0ffa8c60d11ce60a122fe1fd664d215e2df5be1aa34074aa5bd41441997db79e00436ee91f0d0a51390fa
SHA1 hash: f1766e13838f8d5afe58c0c7b14b61c7b3109fe5
MD5 hash: a747b9559e2a63f7216cb36b37d64b52
humanhash: diet-sierra-maine-blue
File name:PURCHASE REQUISITION.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:526'311 bytes
First seen:2020-08-27 05:38:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:mv4wetbhmWvmWHAsAKcWx87HyVOwDlc3WUwHqoCN:mv49s6mXicWWryVOmlc3wCN
TLSH E0B42361375A000C39F258782ED3D923783F89F6FE973682F12FADB51AA875A550235C
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.com
Sending IP: 103.99.3.13
From: MITESH AUTO INDIA PVT LTD <Mitesh@mail.com>
Subject: FWD: QUOTATION
Attachment: PURCHASE REQUISITION.rar (contains "PURCHASE REQUISITION.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f4f6eb511e3968c7473d795f816224ce53bdaff081d87e8399e6efdcab42173/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 05:27:25 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j5hw5nir4oliy5dt26k7qfrcjtstxwx7baoyp2bztzxp3svuefzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4f4f6eb511e3968c7473d795f816224ce53bdaff081d87e8399e6efdcab42173

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 4f4f6eb511e3968c7473d795f816224ce53bdaff081d87e8399e6efdcab42173

(this sample)

AgentTesla

Executable exe a4aa4637f92e6d1f0faea8c071cd561b154e3539a169976ebede90acf6760b99

  
Dropping
MD5 40510e21e4d0beb74d4d0ef2f2871bda
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a4aa4637f92e6d1f0faea8c071cd561b154e3539a169976ebede90acf6760b99

Comments