MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fed813cc1dd74a0d250898dbc3ed91971d55a35d0ca91c870d4015b72cff4f02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fed813cc1dd74a0d250898dbc3ed91971d55a35d0ca91c870d4015b72cff4f02
SHA3-384 hash: 7ace2ccf2acea23791f03c8c723f8d3e9e3caa6072de1af63b0d0f17064b7d3871cf0684a281ce41e8763b09364a18df
SHA1 hash: 29c3ac4fbf82ddb74fe518822786990aab7955ea
MD5 hash: c6c43063438b41ee7efcacc30fe672af
humanhash: lactose-fish-mexico-kilo
File name:Payment Swift001pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:418'335 bytes
First seen:2020-06-10 07:22:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:wQJpGhG1jcxRN9wrBJw2CB0MNz6TgjCunkAaah1:wQKQ1wNwBJwlx60CukAaah1
TLSH F09423CA5599AA2CD6CC63D304342591201432FEDCDABB849397D964B399CE7F3B0FA1
Reporter abuse_ch
Tags:AgentTesla rar Yahoo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic312-27.consmr.mail.ir2.yahoo.com
Sending IP: 77.238.178.98
From: marketing <mcelectronicagualegauy@yahoo.com>
Reply-To: marketing <mcelectronicagualegauy@yahoo.com>
Subject: Fw: USD Payment Swift
Attachment: Payment Swift001pdf.rar (contains "Payment Swift001#pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Spyware.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 07:24:05 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=73mbhta525fa2jiitdn4h3mrs4ovli25bsurzbyniak3olh7j4ba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar fed813cc1dd74a0d250898dbc3ed91971d55a35d0ca91c870d4015b72cff4f02

(this sample)

AgentTesla

Executable exe 950a7326c17a7d8d5eefd99b7df2771f6fd3a5a4942ec2f25252c73e02deecf0

  
Dropping
MD5 0878db5881c050c9b1f8b885b4fdb464
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 950a7326c17a7d8d5eefd99b7df2771f6fd3a5a4942ec2f25252c73e02deecf0

Comments