MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 229e1e292b76f906d33a2ef040cb4089ed08c60469137bc385dbe54bb6bb0eab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 229e1e292b76f906d33a2ef040cb4089ed08c60469137bc385dbe54bb6bb0eab
SHA3-384 hash: 068f3b3dd6962dfe2793a3f0c5fd221d4af8986312fdec7af0b9edec6c6e0b43fd28967fd96c61083e2b543e956655ad
SHA1 hash: 68af0b4b3c42721909eee594f173183f78b53e18
MD5 hash: baa55c4a48111bd6ebe76b7a76101c25
humanhash: cold-lake-uncle-hamper
File name:Universal310720.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:445'375 bytes
First seen:2020-07-31 12:16:02 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:U5S+XMIlCj/7Lw5ePKPAA35vBulyhpI8xWgJRGd8PR:U5S+XMIAj/7LQePKPAAJvD/I8XRGGPR
TLSH 7A9423460FA8764DDF05632625C4CF24AE07BE7D4C78ABB63A383A80D296B05D17D7B0
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: abaad.om
Sending IP: 37.49.230.200
From: Syamkumar Korat <syam.kumar@abaad.om>
Subject: Bank Transfer Advice
Attachment: Universal310720.Z (contains "Universal310720.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/229e1e292b76f906d33a2ef040cb4089ed08c60469137bc385dbe54bb6bb0eab/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 12:17:05 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ekpb4kjlo34qnuz2f3yebs2arhwqrrqenejxxq4f3psuxnv3b2vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/229e1e292b76f906d33a2ef040cb4089ed08c60469137bc385dbe54bb6bb0eab

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 229e1e292b76f906d33a2ef040cb4089ed08c60469137bc385dbe54bb6bb0eab

(this sample)

AgentTesla

Executable exe 1c94475216a36fd670d2d6512f4a4347f809847a0491b768f81fa33fa00ccc83

  
Dropping
MD5 c5e7345ea96addff57be87be8b772090
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1c94475216a36fd670d2d6512f4a4347f809847a0491b768f81fa33fa00ccc83

Comments