MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2597f1bb4b16d92ed4c58bd83dc0ff0e10dcc7c01e51d8c37ed47f9fdac0ba37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2597f1bb4b16d92ed4c58bd83dc0ff0e10dcc7c01e51d8c37ed47f9fdac0ba37
SHA3-384 hash: 8f008a28b6002ba1a81da2a366aae399abeb4d604ace158191d2c1e995b8f96ec796f0875ea3e0fe4a3ab5ba066db715
SHA1 hash: 31b2ed71c9c7ee7975d48a13dfb2ce8a9b5c503e
MD5 hash: 7894595656b243531f74e0e4302cb4bc
humanhash: gee-foxtrot-november-texas
File name:payment slip.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:550'985 bytes
First seen:2020-08-30 05:49:17 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:ssveQhdjXvvOxYaIuNd3bZppR7evuhgn7w/SrzTELLkK:TveMdjXvveYyN1FnAmgE/2m
TLSH 4BC4233DC1BBEFCA5D552A0106EE3F9E962DFC8030590927B55D6ADE293398E431A13C
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email
From: "Purchase Dept." <contabilidad@farletza.pe>
Received: from host.pstecaudiosource.org (host.pstecaudiosource.org [50.28.51.125])
Date: Sat, 29 Aug 2020 06:09:37 -1000
Subject: FWD: Delayed Payment Due To COVID-19 Situation
Attachment: payment slip.pdf.z

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2597f1bb4b16d92ed4c58bd83dc0ff0e10dcc7c01e51d8c37ed47f9fdac0ba37/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-08-29 18:24:14 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
14 of 47 (29.79%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ewl7do2lc3ms5vgfrpmd3qh7byinzr6adzi5rq362r7z7wwaxi3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2597f1bb4b16d92ed4c58bd83dc0ff0e10dcc7c01e51d8c37ed47f9fdac0ba37

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 2597f1bb4b16d92ed4c58bd83dc0ff0e10dcc7c01e51d8c37ed47f9fdac0ba37

(this sample)

AgentTesla

Executable exe e6833e7251b43920130d950de4c5ba68ce8987309114b9d3803f10cfc7834446

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6833e7251b43920130d950de4c5ba68ce8987309114b9d3803f10cfc7834446
  
Dropping
AgentTesla

Comments