MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0dc7b5c33dfe82362ace4f4936a39e9f3fb832620ce94698bb59f33aed3a1fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0dc7b5c33dfe82362ace4f4936a39e9f3fb832620ce94698bb59f33aed3a1fd
SHA3-384 hash: 7a593adfab53714c8963069f187495de3cc4d76e144469eccf5aad87c0b6f9a776b9334a451e36b517f6dcf63c84ab99
SHA1 hash: 1057bd753f10f835d69d439611397b52c8ccee6c
MD5 hash: fb832ce4d3bd36087de4d14318cde84d
humanhash: aspen-winter-sad-princess
File name:Scan doc.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:440'433 bytes
First seen:2020-07-09 14:26:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:6Uk1YTBL+Wko4yX6BwYymaESFrSI/G5Sb4ALox5iO:6ldjyX6mYC3mI/oSbLIH
TLSH 299423F010C09B6EF74AF6E3C95614F02375A73ABB8AC3E8169E9619961E234441CB6D
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pro21.emailserver.vn
Sending IP: 103.15.48.241
From: Guo Hongkun <trangth@newbev.vn>
Subject: Payment Sent T/T Receipt Attached - Overdue Invoices Payment
Attachment: Scan doc.rar (contains "Scan doc.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d0dc7b5c33dfe82362ace4f4936a39e9f3fb832620ce94698bb59f33aed3a1fd/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 14:28:11 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2dohwxbt37ucgyvm4t2jg2rz5hz7xazgedhji2mlwwpthlwtuh6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar d0dc7b5c33dfe82362ace4f4936a39e9f3fb832620ce94698bb59f33aed3a1fd

(this sample)

AgentTesla

Executable exe 7748f1dcea952ed6c4fca8e3bfa378bbb2e3d2da2938a9215d988c16207b1eb8

  
Dropping
MD5 7642dcbb079fc8e3c4b091ff740ac848
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7748f1dcea952ed6c4fca8e3bfa378bbb2e3d2da2938a9215d988c16207b1eb8

Comments