MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef62eb839c24afc31dee2adcbdc5350cf37c8ad386b9af77a7751135d978831e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef62eb839c24afc31dee2adcbdc5350cf37c8ad386b9af77a7751135d978831e
SHA3-384 hash: 5f8cadd93a0dc0875b620ff4994c46e6a21d2e7bb343284af0cc8a620cfdcbbf50775f7263caf59049df2f0b4b727708
SHA1 hash: f0d0b6e3dcbbe44a757861f6baa113c8cd7c0c0e
MD5 hash: 9db304a7a45d9d1dd225cbc8efe9cfec
humanhash: delaware-fillet-delaware-skylark
File name:PV-23815-RECEIPT.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:448'048 bytes
First seen:2020-06-17 05:38:10 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:TlcjmtCLmPZ75IAzsdpl2jxIxiAYKJSfgBQZ2obDk1XeGeTsmmVE9eAVg/Km3:6O9hNSpl2lJAzSEgbDwuGokVE9ZVgX
TLSH 679423CE011720EF130D7AAFE760E8ED75EF890AE36E0C0D95B4B86995D701137AAC49
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.130ads.com
Sending IP: 209.124.90.180
From: Agnes Rajarathenam <info@columbiaasia.com>
Subject: RE: TT PAYMENT ADVICE
Attachment: PV-23815-RECEIPT.r00 (contains "PV-23815-RECEIPT.exe")

AgentTesla SMTP exfil server:
mail.almushrefcoop.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 05:40:06 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=55roxa44esx4ghpoflol3rjvbtzxzcwtq242655houitlwlyqmpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 ef62eb839c24afc31dee2adcbdc5350cf37c8ad386b9af77a7751135d978831e

(this sample)

AgentTesla

Executable exe 8620876c548441699597c4d832de70efc7d058313adeab79c317dbbbd9a3af25

  
Dropping
MD5 63b59d5944bb1adbb5a1d5300bd09781
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8620876c548441699597c4d832de70efc7d058313adeab79c317dbbbd9a3af25

Comments