MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f54b5e3e89496a22f582ac3b79fb27836c37ed8f7c933ee90247000ba70b21b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f54b5e3e89496a22f582ac3b79fb27836c37ed8f7c933ee90247000ba70b21b8
SHA3-384 hash: a65354c5e1eec2b3e46bd188d0c2cb620a43110a2756dcedf3e8378420f8951b8c1d242086d91c17b39d47cf8d2032cd
SHA1 hash: 65f5756e6e3fe048741fb01f92f841812e2f8448
MD5 hash: 9ce9cd849143011a5255914d6eb14e10
humanhash: green-single-alabama-lithium
File name:order_655718476_08.12.2020_08.12.2020_.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:909'154 bytes
First seen:2020-12-17 08:40:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:FQ5TzvwK98UxaAIWfRumRzMb9nN+Ggb5Dkhb6O9F:+twK98IaFbHJ25ghb6O/
TLSH 4C1533379DB373328C659AAC05F36D3E772035CFA538AC7520184167F05A21EAF1A67A
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pablo.sineer.web.tr
Sending IP: 89.43.29.119
From: import - export <info@aldemirlerltd.com>
Subject: Urgent Inquiry
Attachment: order_655718476_08.12.2020_08.12.2020_.rar (contains "order_655718476_08.12.2020_08.12.2020_.exe")

AgentTesla SMTP exfil server:
mail.sidecrown.com:587

AgentTesla SMTP exfil email address:
palacemutfak@sidecrown.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f54b5e3e89496a22f582ac3b79fb27836c37ed8f7c933ee90247000ba70b21b8/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-17 08:41:12 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6vfv4pujjfvcf5mcvq5xt6zhqnwdp3mppsjt52ici4aaxjyleg4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f54b5e3e89496a22f582ac3b79fb27836c37ed8f7c933ee90247000ba70b21b8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f54b5e3e89496a22f582ac3b79fb27836c37ed8f7c933ee90247000ba70b21b8

(this sample)

AgentTesla

Executable exe 0afbb2d6b0c38e92e6456bc50d374ce79065bd39f90c0898fd96ed3aa2428e9f

  
Dropping
MD5 6b1e934f92552b16b03103cd020e7815
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0afbb2d6b0c38e92e6456bc50d374ce79065bd39f90c0898fd96ed3aa2428e9f

Comments