MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0384d5794b195b37bc3a11d5b540b9d421f24b26431aafe3bd4bd5f2bf24abc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0384d5794b195b37bc3a11d5b540b9d421f24b26431aafe3bd4bd5f2bf24abc5
SHA3-384 hash: 8d87f6bb975dc94a7aac056f35d5a5441beedc997eff3cd1d0aadfdedee05c67a280835a7d9672e81e854235794eefc2
SHA1 hash: db037fb259e06a14943293ae503100bc1ef3b1c4
MD5 hash: 593162d3c97496e003502cd95878babb
humanhash: beryllium-ten-papa-ceiling
File name:45675678_B.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:454'354 bytes
First seen:2020-05-07 11:57:54 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:8TIGiZYDFj6cT+NMbYVv7aFr8ziAme9owGSb75siMtfTW/R+sffmDT9NeFfcxhRL:9wFj6g6MY+rLezdCfTW/CT9NeFkhr
TLSH C2A4237BD7C06682A544ACC89E0E632C607D913BBD4CD637076EF5B1A7A051FD3B2A18
Reporter abuse_ch
Tags:AgentTesla ESP geo gz Santander


Avatar
abuse_ch
Malspam distributing AgentTesla:

Sending IP: 185.66.40.36
From: Factoring y Confirming - Grupo Santander <fycuot@gruposantander.com>
Subject: Confirming - Aviso de pago
Attachment: 45675678_B.GZ (contains "45675678_B.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Autorun
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 12:36:21 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aocnk6kldfntppb2chk3kqfz2qq7eszgimnk7y55jpk7fpzevpcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 0384d5794b195b37bc3a11d5b540b9d421f24b26431aafe3bd4bd5f2bf24abc5

(this sample)

AgentTesla

Executable exe 67b2cd29fa6e7d0e7b435506d26c026e853e137dd4cc49f714859f9d75a9a546

  
Dropping
MD5 c677085630237e46e5d80f69ab090ad0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 67b2cd29fa6e7d0e7b435506d26c026e853e137dd4cc49f714859f9d75a9a546

Comments