MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a1649fe96f3711a5af037918c440701ac828722879d118e12e761541c266490. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a1649fe96f3711a5af037918c440701ac828722879d118e12e761541c266490
SHA3-384 hash: 114844185701da48c5e0464f7c2930fbba019ec2c996bfd98892d37ec3024b719b22d5d7b677bbf1c858c7c265338c24
SHA1 hash: e793f18fd7e3699f6602df3865b3746a5a7b4b61
MD5 hash: 2e22eadb2945460207f501017ff6d6ba
humanhash: quebec-seven-autumn-autumn
File name:Pictures,Invoice,5x40ft Containers.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:778'237 bytes
First seen:2020-06-20 08:41:33 UTC
Last seen:2020-06-20 12:52:11 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:IWSj1WuEwy6r3DN3Mt+wSRaiGG5u12dZDbMlPxPoEWI0tbVTmh1VM0aOoz:IWgQwrrT9ifvG0ITDKZWIYTo+
TLSH 97F4232B31BC5D5E3318AF1DD90A35EF89957B7EFA675608E86604FE0E4461932CC1E0
Reporter abuse_ch
Tags:AgentTesla Yahoo z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic307-54.consmr.mail.gq1.yahoo.com
Sending IP: 98.137.64.30
From: Micheal Gauger <r_palari@yahoo.com>
Reply-To: onnybekee@protonmail.com
Subject: Re: Ready For Shipment
Attachment: Pictures,Invoice,5x40ft Containers.z (contains "5X40ft Containers.exe")

AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25244.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 08:43:04 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dilet7uw6nyruwxqg6iyyrahagwifbzcq6orddqs45qvihbgmsia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1a1649fe96f3711a5af037918c440701ac828722879d118e12e761541c266490

(this sample)

AgentTesla

Executable exe cebc844f3daddf87ea7763dafad1989b62052fe2264a4eb2ed9438e67789bc72

  
Dropping
MD5 21392c35fff25aa5aca7dd5b38d07db3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cebc844f3daddf87ea7763dafad1989b62052fe2264a4eb2ed9438e67789bc72
  
Dropping
SHA256 ef96df6ea910efa18ab195dcdc724bb1f405d520862da83da33ce31a7f405c47
  
Dropping
MD5 cd9794b192b65afe8eb044f5da433695

Comments