MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79fbbafa1af494816dd97911a42e92533c7cc220db355fb5d6836a3892dcf9a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79fbbafa1af494816dd97911a42e92533c7cc220db355fb5d6836a3892dcf9a1
SHA3-384 hash: ef4f54d07142dfc19fe09753d3d2dc98ab30b4e693a5a0c94dea543d8916c9e70384d4df1d9f5ecc6afd12dcb34d95ab
SHA1 hash: 5aa0490f54ac3bcbc0ccfc1453d06b8e988d9375
MD5 hash: da529f7d17ec7e73b6165bb91de34835
humanhash: echo-nebraska-oranges-bakerloo
File name:fan Damage.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:820'327 bytes
First seen:2020-12-07 14:17:23 UTC
Last seen:2020-12-09 15:06:38 UTC
File type: rar
MIME type:application/x-rar
ssdeep 24576:8CEw8seEo18jawTWQDodAzytr0CRJnZ7t:8dVSo18GdKodgyttRVZh
TLSH 740523FFB5B1867DE8A8C21C0762D69EC994D109C291E78E37FA857600D8F09B61F607
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Pu, Xin <xin.pu@siemens.com>" (likely spoofed)
Received: "from siemens.com (unknown [103.99.1.174]) "
Date: "7 Dec 2020 05:58:16 -0800"
Subject: "RE RE; Technical confirmation on GV fan"
Attachment: "fan Damage.rar"

Intelligence

File Origin
# of uploads :
4
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79fbbafa1af494816dd97911a42e92533c7cc220db355fb5d6836a3892dcf9a1/
Threat name:
ByteCode-MSIL.Trojan.Malrep
Create hunting rule
Status:
Suspicious
First seen:
2020-12-07 14:18:05 UTC
File Type:
Binary (Archive)
Extracted files:
41
AV detection:
9 of 29 (31.03%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ph53v6q26skic3ozpei2iluskm6hzqra3m2v7nowqnvdrew47gqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/79fbbafa1af494816dd97911a42e92533c7cc220db355fb5d6836a3892dcf9a1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 79fbbafa1af494816dd97911a42e92533c7cc220db355fb5d6836a3892dcf9a1

(this sample)

AgentTesla

Executable exe f0559a0fd007401e0c921c215d318e3232abd6b83e4b0a144977f7e0fcd52b49

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f0559a0fd007401e0c921c215d318e3232abd6b83e4b0a144977f7e0fcd52b49
  
Dropping
AgentTesla

Comments