MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef0a4aedb8fd96ac46d6e572c9632b281c8002d23f374c1b330c54d9fa6aa875. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef0a4aedb8fd96ac46d6e572c9632b281c8002d23f374c1b330c54d9fa6aa875
SHA3-384 hash: 4c5fc9d4e22a567900392e5b37bd522fe78f32483e81e2269849ae2f312aa4d87adebb28320efffe175599036e525a7d
SHA1 hash: 81420c45f8e432fdbc1eebf5b5d87e965df8ab0c
MD5 hash: 9a97af8890b47135fb2810ad70cbaf0b
humanhash: eleven-pennsylvania-beer-zulu
File name:WRONG BANK DETAILS.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:742'195 bytes
First seen:2020-11-18 09:10:29 UTC
Last seen:2020-11-19 12:43:38 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:b7SJKA7QZcFR04gHHQfbufNb2HJwuaLmFIDAyuIY4JKxSKwGf9y5:18QMR07wzpwuaGJHJwOk
TLSH 18F42390C9EA38632FC34564332DF3525615BEA23F0FDAA1C4140F6C355987A399B9E7
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Jessica <cs01@jandragon.com>" (likely spoofed)
Received: "from jandragon.com (unknown [103.145.252.171]) "
Date: "19 Nov 2020 04:41:05 -0800"
Subject: "RE: RE: PAYMENT DETAILS {URGENT REPLY!"
Attachment: "WRONG BANK DETAILS.rar"

Intelligence

File Origin
# of uploads :
6
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef0a4aedb8fd96ac46d6e572c9632b281c8002d23f374c1b330c54d9fa6aa875/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 09:11:04 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=54fev3ny7wlkyrww4vzmsyzlfaoiaawsh43uygztbrknt6tkvb2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ef0a4aedb8fd96ac46d6e572c9632b281c8002d23f374c1b330c54d9fa6aa875

(this sample)

AgentTesla

Executable exe 72ad22e7df09e217184e472645352c8bfe28a44afe5fda4659f4082268d33da3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 72ad22e7df09e217184e472645352c8bfe28a44afe5fda4659f4082268d33da3
  
Dropping
AgentTesla

Comments