MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f4c30b5aa8635ca23faa60523951bed7c60d7a0a5838c4f84564bc2c36cbb03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f4c30b5aa8635ca23faa60523951bed7c60d7a0a5838c4f84564bc2c36cbb03
SHA3-384 hash: 1f83925b257929d2056f9060a151210d2186502b6eb270c6dca5058b78bdd13627105d4ecb173ea775b01e31ad26e358
SHA1 hash: a61523027bd7c24e659d5e6375007d22ce388bdf
MD5 hash: 848f8a6f95e9436df1718dcf6bb5c44a
humanhash: maryland-edward-missouri-four
File name:PURCHASE ORDER.XZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:446'844 bytes
First seen:2020-07-10 05:30:41 UTC
Last seen:2020-07-11 12:20:03 UTC
File type: xz
MIME type:application/x-rar
ssdeep 6144:gAyhzJlgIlw/kC34Q84JssqRsPj7DsI+aAvZDlAddfRGPXJlvDpzqAPXhJ:0lgI6kUz84UsPD9RecdMrvXhJ
TLSH 2B9423901C83D56135E218A3752AAE3A3CD06FFD47D4B26FAD7B3561DE2C26D087D80A
Reporter cocaman
Tags:AgentTesla xz


Avatar
cocaman
Malicious email
From: jason@sigasia.org
Received: from 142-4-22-49.unifiedlayer.com (142-4-22-49.unifiedlayer.com [142.4.22.49])
Date: Fri, 10 Jul 2020 10:52:20 -0600
Subject: INVOICE
Attachment: INVOICE.XZ

Intelligence

File Origin
# of uploads :
3
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f4c30b5aa8635ca23faa60523951bed7c60d7a0a5838c4f84564bc2c36cbb03/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 05:32:06 UTC
File Type:
Binary (Archive)
Extracted files:
69
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t5gdbnnkqy24ui72uycshfi35v6gbv5auwbyyt4ekzf4fq3mxmbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz 9f4c30b5aa8635ca23faa60523951bed7c60d7a0a5838c4f84564bc2c36cbb03

(this sample)

AgentTesla

Executable exe 0ccbeda394779c45187dd20ce04861c0e31f97e805e4c24fc4447601ba195591

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0ccbeda394779c45187dd20ce04861c0e31f97e805e4c24fc4447601ba195591
  
Dropping
AgentTesla

Comments