MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fef6e799f00f697003ecc3b174c075f204191593a2b0d4ce12d20a2f9ac5cf6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fef6e799f00f697003ecc3b174c075f204191593a2b0d4ce12d20a2f9ac5cf6c
SHA3-384 hash: 2c22e15dd8b9fbcd9657fa6b5cbc91f6371e45cae723c109bf94eb717ddf70f895a1108050e39fc11b855ef67ad4224b
SHA1 hash: ba3748f1732e3ecf16ed770d73503a1ebe2976f7
MD5 hash: e0021889a41ce23254936702fd3d55bc
humanhash: mockingbird-pennsylvania-moon-bluebird
File name:New Order_7464536.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-02 07:02:31 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:PJeD/tMr8VMOefPaRBx7lR37jaZCQ2bHzyk09zbCwSFP79P+xw+z4IUxGh4McVb:M/tS8VYUfNdFTWz0JPQT4IIG1c
TLSH 0445E02427EC9228FD7E1B31EAB55244537379986432D31D221CA05E1FBBF858AA17B3
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: msa-smtp6.hinet.net
Sending IP: 168.95.6.56
From: info@dividerpartitions.com
Subject: Request Quotation/medical equipment
Attachment: New Order_7464536.img (contains "Quotation.exe")

AgentTesla C2:
http://nat.llogo2y.com//inc/7e59ef6ba55f5e.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FVRCBD0C1658555.257.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fef6e799f00f697003ecc3b174c075f204191593a2b0d4ce12d20a2f9ac5cf6c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 07:04:05 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=733opgpqb5uxaa7myoyxjqdv6icbsfmtukynjtqs2ifc7gwfz5wa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img fef6e799f00f697003ecc3b174c075f204191593a2b0d4ce12d20a2f9ac5cf6c

(this sample)

AgentTesla

Executable exe ddcbfd603bcb3714152a53ed196c35068a3da408e6f80b239403ac3d903110e8

  
Dropping
MD5 cbd0c1658555a825061579d2f1c9c107
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ddcbfd603bcb3714152a53ed196c35068a3da408e6f80b239403ac3d903110e8

Comments