MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14d449a3be89bf4e359b7e81a5ade02fa5c3434cd142040aa0804ab495bdc24b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14d449a3be89bf4e359b7e81a5ade02fa5c3434cd142040aa0804ab495bdc24b
SHA3-384 hash: 9a550c00ef72fe2691a1f639c6a40700e127c7b6ede893c86c5b0dea0ecd0e481168b46af3e9e6c39e14bcdbb9c2aedf
SHA1 hash: 08512402f48a5df3b60a22124e81b23caacea2da
MD5 hash: 917fa48e191bd8650c8d34d039c57649
humanhash: vermont-music-white-magazine
File name:Wood carving disc.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:317'017 bytes
First seen:2020-06-08 06:43:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:D4a2lsTMJunenFBk9xW2rE6+QCDh5EJSQtB:D4aU/zU9Odhod
TLSH 7B6423104E9D7A3E9D3B7018D62CEDA8A7DFE3A5B003788911C452B265F05D36B34A3A
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gmail.com
Sending IP: 156.96.59.32
From: ''Lucas Zhang''<Lucas Zhang@gmail.com>
Reply-To: Paulrodriguez723@gmail.com
Subject: Wood carving disc
Attachment: Wood carving disc.zip (contains "Wood carving disc.exe")

AgentTesla C2:
http://vanoshe.ir/wp-includes/Requests/m/ori/inc/66c683de98ad89.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 06:45:04 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ctketi56rg7u4nm3p2a2llpaf6s4gq2m2fbaicvaqbfljfn5yjfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 14d449a3be89bf4e359b7e81a5ade02fa5c3434cd142040aa0804ab495bdc24b

(this sample)

AgentTesla

Executable exe 3f58539eb2353fb30a4d0d2e3e1f8db5c51a21df564c138953fbe1e2bb396284

  
Dropping
MD5 72fea827470330670dd35c6cf1b6ba2b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3f58539eb2353fb30a4d0d2e3e1f8db5c51a21df564c138953fbe1e2bb396284

Comments