MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34f589d7f3786db16000cca71ff8acf99cfd5a9a157bfb470c7cc6f3da501520. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34f589d7f3786db16000cca71ff8acf99cfd5a9a157bfb470c7cc6f3da501520
SHA3-384 hash: 026eb663c3a4f38ad90e45c944f65f30c7580140682f4f43380388f9de8bcd9b56f43a5ba91d0cecf12fe0d3ff205b7a
SHA1 hash: 3d7098a4b92252726161cb3ced3a8bc1fc1fa624
MD5 hash: 2f6192c0d8e2fae832cb31a01f3e705d
humanhash: six-river-kitten-wyoming
File name:Bank Payment Slip.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:403'694 bytes
First seen:2020-06-26 07:08:22 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:5tWkXAAbAnPVfyms6V/cHMgRtSP8uIp90L:5tFwpPVfyMV/cMgRLq
TLSH F48423FCFBA0880A5F21415478E6B91AC7E61887339FF1267FDC636491A0154FC2B8DA
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: eurotrading.bologna.it
Sending IP: 37.49.224.4
From: carla@eurotrading.bologna.it
Subject: Bank Payment Slip468390
Attachment: Bank Payment Slip.zip (contains "Bank Payment Slip.exe")

AgentTesla SMTP exfil server:
smtp.bnb-spa.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.f75bcb16ae21df7e.11718.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34f589d7f3786db16000cca71ff8acf99cfd5a9a157bfb470c7cc6f3da501520/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 02:04:40 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gt2ytv7tpbw3cyaazstr76fm7gop2wu2cv57wrymptdphwsqcuqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 34f589d7f3786db16000cca71ff8acf99cfd5a9a157bfb470c7cc6f3da501520

(this sample)

AgentTesla

Executable exe 785eae41853aa5f05fd28eee5c3c009d23e4aea065bb6393afd23e37bfc54819

  
Dropping
MD5 c160aa5c2d42587a5a5a692aec00c97f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 785eae41853aa5f05fd28eee5c3c009d23e4aea065bb6393afd23e37bfc54819

Comments