MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17d892c35fd78db2e73b89312d9b00975d4132e64c22b182126cabcd79290388. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 17d892c35fd78db2e73b89312d9b00975d4132e64c22b182126cabcd79290388
SHA3-384 hash: c63c717007bafdc68d308b3d8f411b2b9e9644b87fe3c472a7c60ac5b289e83868b5951581f94956aef31ceda1affb87
SHA1 hash: 79a64086eb14977a2e1992bd830d7cf2a368d09c
MD5 hash: d78624833fb002039528d5d7e10c76e0
humanhash: cold-finch-muppet-seventeen
File name:INV_61119000787-0499201911.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:392'468 bytes
First seen:2020-06-26 06:15:48 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:HAiKSupG3EE2OivzWUcvsrodX9fxcq0Dwc7BnP1ufacbBqFvxFwKspbeZbK:gizEXvzWKrsX9fGpwWBnP1WbBqFvxCKI
TLSH B68423483BFC95679F924B9C6A3C22872E98D21154CD0AB53C520BEC1F09A1ECE339D7
Reporter abuse_ch
Tags:7z AgentTesla geo JPN


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: fosetico.com
Sending IP: 109.228.8.101
From: Akio Takuma <akiotakuma2@gmail.com>
Attachment: INV_61119000787-0499201911.7z (contains "INV_61119000787-0499201911.exe")

AgentTesla SMTP exfil server:
mail.protege.com.mx:587

AgentTesla SMTP exfil email address:
veronica.serrato@protege.com.mx

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/17d892c35fd78db2e73b89312d9b00975d4132e64c22b182126cabcd79290388/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 06:17:04 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c7mjfq2726g3fzz3reys3gyas5oucmxgjqrldaqsnsv426jjaoea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 17d892c35fd78db2e73b89312d9b00975d4132e64c22b182126cabcd79290388

(this sample)

AgentTesla

Executable exe c6f9b1e471a5ef092f97c961777b949d5f7ddb47db83ae302cca793e41daed40

  
Dropping
MD5 9499e0e847b8952ed78eb2496337edca
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c6f9b1e471a5ef092f97c961777b949d5f7ddb47db83ae302cca793e41daed40

Comments