MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66f22d7fae050365d8a95b8c858ee6e1bd7ce877136485b30de9f47637caa365. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 66f22d7fae050365d8a95b8c858ee6e1bd7ce877136485b30de9f47637caa365
SHA3-384 hash: 6a5d8254de0c94352ce934e235d4455abcab323f0a3452115a37fb354094506b102cb7ed84e89b516d77635a11fcb5fb
SHA1 hash: c81ebd9704bcbc3c3a030fe4bec9d171b29e00c6
MD5 hash: 6a2e55571bd9ada23410b464161f2ea5
humanhash: asparagus-oxygen-carbon-high
File name:Receipt.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:4'845'883 bytes
First seen:2020-07-06 06:28:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 98304:0W6Crm6lWTXeInNG6vQ7q6ONMaLZ5tL/kYzBYV+vmEykrdnH7lAXKb:0bUlmXZNG6vQm6ONMaLBbrFYV+vmidH1
TLSH F626335D7638B505D8E05F194FA382A8F4CF985C67426AF69CCC3C110DAB0B917E2B2E
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.b-io.co
Sending IP: 185.183.98.177
From: Harrison Contractors<contact@ariapetrolub.fun>
Subject: Re: R: R: Order Confirmation Nr. 2748 of 20102/2020
Attachment: Receipt.rar (contains "Receipt.exe")

AgentTesla SMTP exfil server:
smtp.harrisioncontractors.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/66f22d7fae050365d8a95b8c858ee6e1bd7ce877136485b30de9f47637caa365/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 06:30:09 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m3zc275oaubwlwfjlogildxg4g6xz2dxcnsilmyn5h2hmn6kunsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 66f22d7fae050365d8a95b8c858ee6e1bd7ce877136485b30de9f47637caa365

(this sample)

AgentTesla

Executable exe c5ef70a556489445a18beab8feb6a9058faf0e51967f7185b203734061d2b982

  
Dropping
MD5 845899a5c06735a411d0bc5c29a32703
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c5ef70a556489445a18beab8feb6a9058faf0e51967f7185b203734061d2b982

Comments