MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0456470bbd09bc61ad20ecfa9477bbd1c98452563c4299770a1bff48fe382b46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0456470bbd09bc61ad20ecfa9477bbd1c98452563c4299770a1bff48fe382b46
SHA3-384 hash: e18e2c32eb0ea8c05a5488c46daf04080f22248a5c66ed27236589dd9b4fa45a5e266b012e5aa3a3deb936dd8757da60
SHA1 hash: bb7230bc6054e3af5f609e7b114e00233cfed682
MD5 hash: 9db00ebef9d587373f87891fc0cf85c0
humanhash: lemon-batman-tango-august
File name:Purchase_Order 003790G3.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:390'519 bytes
First seen:2020-07-01 06:16:06 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:kX6o+gYh3XTTEDVOrShH2Jq0XjFWKYi0IiWXn2Gz+Ba/Kp7rf3bdGB7oqKL3vB:kX6bTwDKqMbzWw6Gz+j77xGB7l6B
TLSH 9A8423DB852CB7190183ADC9BBEE813A5D8ECE431CF0A3B154CB1AC1C87366562B5727
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vega.awedns.com
Sending IP: 101.99.77.54
From: Boey <pysin@aathaworld.com>
Reply-To: Boey <nealworkrestblades@yahoo.com>
Subject: Purchase_Order 003790G3
Attachment: Purchase_Order 003790G3.GZ (contains "Purchase_Order 003790G3.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0456470bbd09bc61ad20ecfa9477bbd1c98452563c4299770a1bff48fe382b46/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-01 06:18:06 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=arleoc55bg6gdlja5t5ji5532heyiuswhrbjs5ykdp7ur7ryfnda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 0456470bbd09bc61ad20ecfa9477bbd1c98452563c4299770a1bff48fe382b46

(this sample)

AgentTesla

Executable exe 4df26b68d17a122cf76493624c77ab43037d13f5cc57bb94323e161e6d328ba7

  
Dropping
MD5 6afe97d3fc0f2b983f894eb55a723b85
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4df26b68d17a122cf76493624c77ab43037d13f5cc57bb94323e161e6d328ba7

Comments