MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f07d3110d9ff1ea3b40d386da22aef75fecf1d70b41573ed099a3edac0d21326. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f07d3110d9ff1ea3b40d386da22aef75fecf1d70b41573ed099a3edac0d21326
SHA3-384 hash: 116ca310fe9239e284689adbe857f14936775ec9ce556f85662eec177b86288efa191d5fc3e00a572034183f7d080ad1
SHA1 hash: 3682adb945bd49596a089e0734a8ec0b9f2ba236
MD5 hash: 43f1d6d9f421d087ecd8a4df2a4eaca4
humanhash: earth-zebra-india-friend
File name:Payment Slip.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:544'686 bytes
First seen:2020-10-07 13:59:44 UTC
Last seen:2020-10-08 12:03:05 UTC
File type: arj
MIME type:application/x-rar
ssdeep 12288:c4NtZHs6kzbj8zNB/TQOH6OHH4q0tEI5BC2RXXCSD51+0OFeU4VlXN:c4ZtkAzNB/8OaOn4qYEI5BdyciF94Td
TLSH C9C423BA25583DFFDF88740FBCADB1091FD54A58CA4D425078ACB5F387692520ACACE4
Reporter cocaman
Tags:AgentTesla arj


Avatar
cocaman
Malicious email (T1566.001)
From: "ismail.mertoglu@odc.com.tr"
Received: "from odc.com.tr (unknown [185.222.57.71]) "
Date: "7 Oct 2020 06:34:04 -0700"
Subject: "RE: Payment Slip"
Attachment: "Payment Slip.arj"

Intelligence

File Origin
# of uploads :
2
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f07d3110d9ff1ea3b40d386da22aef75fecf1d70b41573ed099a3edac0d21326/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 13:55:38 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6b6tcegz74pkhnanhbw2ekxpox7m6hlqwqkxh3ijti7nvqgscmta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f07d3110d9ff1ea3b40d386da22aef75fecf1d70b41573ed099a3edac0d21326

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj f07d3110d9ff1ea3b40d386da22aef75fecf1d70b41573ed099a3edac0d21326

(this sample)

AgentTesla

Executable exe 4107ae832e2a94dd12c11823472aba013b3d016efbc357526152a2e0d2d3ca88

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4107ae832e2a94dd12c11823472aba013b3d016efbc357526152a2e0d2d3ca88

Comments