MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fec03020a1c037817aff8b8e9d48c410c2b87e7a852fdb7d60b519db9ec5d7bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fec03020a1c037817aff8b8e9d48c410c2b87e7a852fdb7d60b519db9ec5d7bc
SHA3-384 hash: 457c18ee1d9bd440855245280e9b182a4615a71f4e74ecf6473c54871b14f34f22bd062db0658a24575e76c8dd29fbcf
SHA1 hash: 6ea976cd00db06f5ad58dd5b5924d4c6dd6649ee
MD5 hash: 5eaadef5f7fa855cd9ad4db1fae3d4c2
humanhash: wolfram-maine-king-coffee
File name:SCAN PO TY5676879809_xls.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:281'574 bytes
First seen:2020-10-15 05:08:34 UTC
Last seen:2020-10-16 21:12:57 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:46pKSiE7E6xBUk59eF8h37fK++TEkUrV2hwwq3N6YTsDt4jZ:ppKS3g6fU6XhLKQqMtK49
TLSH 7054238C282A3CE7587BF48DAB535AC3549F4638204B7850BD948DDB410DE5C3ADAADE
Reporter cocaman
Tags:AgentTesla xz


Avatar
cocaman
Malicious email (T1566.001)
From: "Maria Fernandes <Maria@mcsinternational.co.uk>"
Received: "from mcsinternational.co.uk (unknown [45.133.245.115]) "
Date: "15 Oct 2020 02:00:35 -0700"
Subject: "MSC NEW ORDER SCAN PO TY5676879809 "
Attachment: "SCAN PO TY5676879809_xls.xz"

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25544.7zHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fec03020a1c037817aff8b8e9d48c410c2b87e7a852fdb7d60b519db9ec5d7bc/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 01:20:20 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=73adaifbya3yc6x7rohj2sgecdblq7t2qux5w7lawum5xhwf266a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fec03020a1c037817aff8b8e9d48c410c2b87e7a852fdb7d60b519db9ec5d7bc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip fec03020a1c037817aff8b8e9d48c410c2b87e7a852fdb7d60b519db9ec5d7bc

(this sample)

AgentTesla

Executable exe a4f5d50066dec8990f99e1b9dd6d9106204b5d064b9aa9c8e5578820dee27947

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a4f5d50066dec8990f99e1b9dd6d9106204b5d064b9aa9c8e5578820dee27947

Comments