MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa44d7c5a5c46a396cf182a46b91091a25e2e8d38d945d040d61a86467751ab4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa44d7c5a5c46a396cf182a46b91091a25e2e8d38d945d040d61a86467751ab4
SHA3-384 hash: 2cdbda2c087a3354238b4773eaec49ce4920bf6454cd7098fc8b95d534746f44672e8772725123a7cd0ee2c3034ed4a4
SHA1 hash: df46970dc3ca4140aa2ac6560d8aea292ee84e7a
MD5 hash: 362976231dae00da85ae91bd20216dd9
humanhash: north-gee-romeo-burger
File name:NEWORDER.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:377'815 bytes
First seen:2020-05-26 08:19:39 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:16+lpSGhuZXVJS7FMB/Nj/pdopZR36oZ4f3nHr/XQ/y68r6smC7uJP38FMj:16GcmuZlJSwjhdUR6c4fXL/AlY6sx7ct
TLSH C884231D02019F4A6C07CF991BB193982CEBA54F716D8580CAB1AB3EE634D93B9CD15B
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.nevasys.com
Sending IP: 81.23.104.214
From: KIM <printer@kerryeas.com>
Reply-To: abs000010@outlook.com
Subject: New Order Request
Attachment: NEWORDER.rar (contains "NEWORDER.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-16 18:34:53 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar fa44d7c5a5c46a396cf182a46b91091a25e2e8d38d945d040d61a86467751ab4

(this sample)

AgentTesla

Executable exe 539d40c40dbfe906aad27760753e55be6cdf1b7dee6a41672c2d75294fde6900

  
Dropping
MD5 1248a130af361412870b16e4e927c1b9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 539d40c40dbfe906aad27760753e55be6cdf1b7dee6a41672c2d75294fde6900

Comments