MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ffcb43058edbe74b00bb45d66c38c8c8fe86133db415600224eeffd723923bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ffcb43058edbe74b00bb45d66c38c8c8fe86133db415600224eeffd723923bb
SHA3-384 hash: d3248cbd77359d75291b6fbf23e1eb63852e650f80b39e1bbde88cd6c6aa2d8124833e3890de66cab4b83f48003f10a4
SHA1 hash: af40f95fd9036a79c920cdbc6b33201268edc47b
MD5 hash: 40195fc45f9fcaeb6d395ef080b1698f
humanhash: fix-winter-wolfram-pasta
File name:New order.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:745'164 bytes
First seen:2020-10-12 19:29:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:pk3Lke9d48kr/LklWUDLLv6i0mwm2TWjq+nSzwmnmrxfr51A/mfsOoM+r:pGNP4dreLvN0s2TWnnSM6Wfr5CBOoM6
TLSH D5F423F940AB3FC4316C6F65B97468942E86CCDE70819A8531D71D3172A19BC8AA6B33
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: aaturkgroup.com
Sending IP: 103.151.124.245
From: sales@aaturkgroup.com
Subject: Re; New order
Attachment: New order.rar (contains "New order.exe")

AgentTesla SMTP exfil server:
mail.smart-noodles.com:587

AgentTesla SMTP exfil email address:
info@smart-noodles.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25797.RarHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ffcb43058edbe74b00bb45d66c38c8c8fe86133db415600224eeffd723923bb/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 15:16:45 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j76limcy5w7hjmalwrownq4mrsh6qyjt3navmabcj3x724rzeo5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4ffcb43058edbe74b00bb45d66c38c8c8fe86133db415600224eeffd723923bb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 4ffcb43058edbe74b00bb45d66c38c8c8fe86133db415600224eeffd723923bb

(this sample)

AgentTesla

Executable exe a569b8008c92f448c7263b95e26aa73165682eb25778cafe76f45838c7ffdad5

  
Dropping
MD5 03bf93f41eef2e42b84db7c098cf3cec
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a569b8008c92f448c7263b95e26aa73165682eb25778cafe76f45838c7ffdad5

Comments