MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efdb3f27c80bc49202b6e6aac013e5962e766d6ce6cebd8bf081e94e5153a58a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: efdb3f27c80bc49202b6e6aac013e5962e766d6ce6cebd8bf081e94e5153a58a
SHA3-384 hash: 12896c2c17d118b3c361f3a1011f013c1cb7839d52f97b7238ab7d7be56efe823259a878422a52fb5cea707ee687b029
SHA1 hash: ca2fad2323003882c1ab7676031f09c3e000a445
MD5 hash: 654b5582d5ec92266db5c9ca6530004d
humanhash: river-hamper-five-xray
File name:REswift0934567878498_78325_00087209.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:436'390 bytes
First seen:2020-06-14 10:25:39 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:R9CyN3adujTw0XPjUvjgBEDhxpQ8S0R+cJ9WK7EgqlcmdxtBFWEI2bNAr2dN73Fh:hN9TxgBQH0R+uWKAPtBFOEKadF3F39
TLSH 059423C01ADA7FA4E446469B131772DE6A814E5BE46B1435E56FCF800D3F88EADB2D30
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloudvps.personnelconsultant.co.th
Sending IP: 203.78.107.120
From: Raha Manafpour <sales@adimulia.com>
Subject: RE: swift0934567878498_78325_00087209
Attachment: REswift0934567878498_78325_00087209.arj (contains "REswift0934567878498_78325_00087209.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-06-14 10:27:04 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=57nt6j6ibpcjeavw42vmae7fsyxhm3lm43hl3c7qqhuu4uktuwfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj efdb3f27c80bc49202b6e6aac013e5962e766d6ce6cebd8bf081e94e5153a58a

(this sample)

AgentTesla

Executable exe 89581b13e744458c0f64ed2f07f464428f28153862ce5594ed875e3d20b43c23

  
Dropping
MD5 594b9626d4f3b388d460cb50ed402194
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 89581b13e744458c0f64ed2f07f464428f28153862ce5594ed875e3d20b43c23

Comments