MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 270c46d6154ddbf0cc61b47bb63e7b4eb0107eeb9eb94245c4b4c9f5179ef004. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 270c46d6154ddbf0cc61b47bb63e7b4eb0107eeb9eb94245c4b4c9f5179ef004
SHA3-384 hash: ae3a4fdc10589a7d79e08be8258c54b968eb2d09daa313ef914d60399c9d42f5522148b01bc8e4e9c16dc3d872aaae98
SHA1 hash: 7c20189a8613b1833199de1af95bc3b5c1c0294c
MD5 hash: e2ca6c2f46b87b22acb047b8decbb834
humanhash: six-three-beryllium-delaware
File name:contract invoice.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:356'113 bytes
First seen:2020-07-09 18:29:52 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:MjEXavaO5Nu3K9A8jo7xG5IvHHkjSZ/akVLstY70TrLbDUMiSKr5:eEXcaOLH9583vnMaXLsa7CXD1ad
TLSH D87423576E7F6127DC6AC9351D224B32910931E092EAA688F5DD20429E73CEB14FF1E3
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: corrpltd.com
Sending IP: 37.49.230.212
From: Lucy Anderson <seancunnings@corrpltd.com>
Subject: Signed Contract Invoice
Attachment: contract invoice.Z (contains "contract invoice.exe")

AgentTesla SMTP exfil server:
mail.threewaystoharems.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/270c46d6154ddbf0cc61b47bb63e7b4eb0107eeb9eb94245c4b4c9f5179ef004/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 18:31:05 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e4genvqvjxn7btdbwr53mpt3j2yba7xlt24ueroewte7kf466aca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 270c46d6154ddbf0cc61b47bb63e7b4eb0107eeb9eb94245c4b4c9f5179ef004

(this sample)

AgentTesla

Executable exe d9a1fcb2c4fcc8b357ae72a6e3135101e2c15d4c60791df8ce8dd4464d270339

  
Dropping
MD5 761f108a69b4cdc62d7f292ca993f1e9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d9a1fcb2c4fcc8b357ae72a6e3135101e2c15d4c60791df8ce8dd4464d270339

Comments