MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 697468be234b21edf9cff213b3bd255b694ec2a2b0c80fa31d72ed60320bb622. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 697468be234b21edf9cff213b3bd255b694ec2a2b0c80fa31d72ed60320bb622
SHA3-384 hash: 3c661b08b25622cf432a5540528466e701202cb769d7f1271354d1db104cfa9e829440443c5372821d5de07cffa1c072
SHA1 hash: 6f1ed7625df4a9d9a81516be6321a2c722f8b7be
MD5 hash: 0bb71b0c2ff0a60113607fd89fcfb63f
humanhash: kansas-oregon-moon-freddie
File name:Signed Copy Invoice_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:317'927 bytes
First seen:2020-12-08 06:33:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Ec6IdMJ7IFRUQpFkbLhKZAODgvv87nCiJDbTROIISaXFVdxPBzJvXQNSF:tadIlnYLhbOD+v87CiJDbTROIIpXFV1V
TLSH B06423641FAE3CDBE8E9CD4208ECC30A9D06E957AC9C84335A4DC0D179BF927B058275
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Heidi Villiers<e-marketing@fiesta.com>" (likely spoofed)
Received: "from fiesta.com (unknown [23.19.58.30]) "
Date: "07 Dec 2020 17:52:39 -0800"
Subject: "Signed Contract Copy"
Attachment: "Signed Copy Invoice_pdf.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/697468be234b21edf9cff213b3bd255b694ec2a2b0c80fa31d72ed60320bb622/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 05:06:01 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nf2grprdjmq636op6ij3hpjflnuu5qvcwdea7iy5olwwamqlwyra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/697468be234b21edf9cff213b3bd255b694ec2a2b0c80fa31d72ed60320bb622

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 697468be234b21edf9cff213b3bd255b694ec2a2b0c80fa31d72ed60320bb622

(this sample)

AgentTesla

Executable exe bee3c64a4d3862a54f11a05303fb39c9768891841673269e477d0d87ec1862e2

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bee3c64a4d3862a54f11a05303fb39c9768891841673269e477d0d87ec1862e2
  
Dropping
AgentTesla

Comments