MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb941d82b51334f4284145f73f132e05ed68081bfaa939b076e92119b643ab47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb941d82b51334f4284145f73f132e05ed68081bfaa939b076e92119b643ab47
SHA3-384 hash: 7b7c4a18d720bf85168c72bb8369523f5578cc23861093b06dd0757b463b490a619f8c740cca85fb6889690c596fc56b
SHA1 hash: c1aad6656eecc9820ccfb0790e06215a1ea7466b
MD5 hash: 67c864256b864f527b4b10caad51ece5
humanhash: music-tennis-four-sad
File name:BL-LADING#ATA-3678920.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:644'035 bytes
First seen:2020-09-11 05:13:08 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Rcs9IGalz3CMwLhmy7Tlvth2peeOiynZYe6bogzzgh35NTd13T/rR4h+J/:Ws9iKv7BD2pdOiynX6bYtDf3zc+p
TLSH 3BD4237D87B98F40644DB8D2AC0DBCC0B33E6CF6ED964A7242A98F94DD4A095D2423DC
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email
From: Ata-cargo>sales@ata-cargo.com
Received: from ata-cargo.com (unknown [103.133.106.246])
Date: 10 Sep 2020 22:11:26 -0700
Subject: Re: Fw:BL-LADING#ATA-3678920.pdf
Attachment: BL-LADING#ATA-3678920.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb941d82b51334f4284145f73f132e05ed68081bfaa939b076e92119b643ab47/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-11 05:15:07 UTC
File Type:
Binary (Archive)
Extracted files:
71
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7okb3avvcm2pikcbix3t6ezoaxwwqca37kuttmdw5eqrtnsdvndq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fb941d82b51334f4284145f73f132e05ed68081bfaa939b076e92119b643ab47

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar fb941d82b51334f4284145f73f132e05ed68081bfaa939b076e92119b643ab47

(this sample)

AgentTesla

Executable exe e7bd0a2c83baca8fac289c1b43a3922ba487b2e7eddb13d82e584d6bdc0086b2

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e7bd0a2c83baca8fac289c1b43a3922ba487b2e7eddb13d82e584d6bdc0086b2
  
Dropping
AgentTesla

Comments