MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 985ae214f7b4bf169cf8d653260e80457f9b63a76fe45f571269a3ccf561a0bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 985ae214f7b4bf169cf8d653260e80457f9b63a76fe45f571269a3ccf561a0bc
SHA3-384 hash: 80e8e9e7286da079ca38634f03bf88ff39eba3356edf81e5a88e7d598a4f6f05f80714b112fa3ea557bbd44b60077e74
SHA1 hash: 853272bef4ea3d0f6cb45030a26b72260acf9901
MD5 hash: d62fa0d4b662f2248a6251865de8797b
humanhash: thirteen-aspen-oklahoma-nineteen
File name:Remittance Advice 001-ADEG001pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:956'959 bytes
First seen:2020-07-11 16:52:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:YyW8OwQBXH/A0jk6wzcIeK9IpdXE46FrUtzAm4JK:/s3/A0j0BVS7/mnI
TLSH 0315332915F442E871E94ECC57103A1DCDDD8FDDFA8B2FEA4A4A5DDA38C50C3A46306A
Reporter abuse_ch
Tags:AgentTesla rar Yahoo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic315-13.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.134.123
From: ばし こ <hello_isi845@yahoo.com>
Subject: Fw: Remittance Advice 001-ADEG001
Attachment: Remittance Advice 001-ADEG001pdf.rar (contains "Remittance Advice 001-ADEG001pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/985ae214f7b4bf169cf8d653260e80457f9b63a76fe45f571269a3ccf561a0bc/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-07-11 16:54:08 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tbnoefhxws7rnhhy2zjsmduaiv7zwy5hn7sf6vysngr4z5lbuc6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 985ae214f7b4bf169cf8d653260e80457f9b63a76fe45f571269a3ccf561a0bc

(this sample)

AgentTesla

Executable exe 1095767d566c69cb1b2b6c80eef101d62dc9736e3ef294b43fc23f3d0378ea60

  
Dropping
MD5 9001a87083fbb220841ba6e7d03008e0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1095767d566c69cb1b2b6c80eef101d62dc9736e3ef294b43fc23f3d0378ea60

Comments