MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17be33f66c8cea48ac61c9b0aef5742e61ca1ce516e09275ae3d5b7932a1be03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 17be33f66c8cea48ac61c9b0aef5742e61ca1ce516e09275ae3d5b7932a1be03
SHA3-384 hash: eb25cdacbab8f2499b281b34662bd4346aa7a9da80ec7db1e66d1316f770e958642e948a9507644f8da0b93c2ea2badc
SHA1 hash: 056d9c0f8a2387265a7b811f4d4128c69e149494
MD5 hash: 27d1f5579ed8a8394a23c5c725510316
humanhash: cup-quebec-fifteen-november
File name:SAMPLE.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:528'949 bytes
First seen:2020-05-12 09:18:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:LRXz2mYik3vbKf7XQcn3t1ZwuJ3nTz7jl0qIfwk5Pd7yjyCDBQLc:S3v+TXnnR3nTz+qIfwghWycJ
TLSH 8AB4237497084F329AFA607E0B087BEC20D27593B62263C706259BD6D5325D6D40BEFB
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.com
Sending IP: 185.234.218.175
From: Mary Kon<secureserver@server.com>
Subject: REQUEST FOR QOUTATION
Attachment: SAMPLE.zip (contains "FILE.exe")

AgentTesla SMTP exfil server:
mail.shrc-india.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BehavesLike.Win32.Fareit.cc.21246.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 09:36:32 UTC
File Type:
Binary (Archive)
Extracted files:
265
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c67dh5tmrtverldbzgyk55lufzq4uhhfc3qje5nohvnxsmvbxybq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 17be33f66c8cea48ac61c9b0aef5742e61ca1ce516e09275ae3d5b7932a1be03

(this sample)

AgentTesla

Executable exe 8d286ef1e89c7538ea015f40f8accaa1430b2f479684fa6804f762326ed11f75

  
Dropping
MD5 fa2f7901f8af7cca63176f0e65499810
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8d286ef1e89c7538ea015f40f8accaa1430b2f479684fa6804f762326ed11f75

Comments