MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3523e4449ba2f20facf79d60512b6ad9f0abdd3954fe9f5449f8196719e851dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3523e4449ba2f20facf79d60512b6ad9f0abdd3954fe9f5449f8196719e851dd
SHA3-384 hash: 08343a9b45401c77a10a5e4faea11aea65d659f8b6425871881da980df6845676dc7035b7cffdea7974e12c14c980519
SHA1 hash: 2054c6122a28be4b1d83a271914f73762439fede
MD5 hash: f7adfef44a4ea5d405593e6c7715be8a
humanhash: king-kansas-thirteen-potato
File name:PO24406042_20200608.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:393'445 bytes
First seen:2020-06-09 06:02:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:t0ngq+2unw9AwbZmuOkcLFwtZtWH+dW30kj1Fd+ljUXSpXak:ingqOw9AahXcGtEDd+ljUCpKk
TLSH 2D84233DA2D301AC3B6B0984B4B5BD91060BA0F985F37F419EF36CA8CBB55816B4D16D
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: kat-germany.de
Sending IP: 156.96.62.213
From: Patrycja Pecherska <pecherska@kat-germany.de>
Subject: Order confirmation
Attachment: PO24406042_20200608.z (contains "PO24406042_20200608.exe")

AgentTesla SMTP exfil server:
mail.skylabelskenya.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.7240.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 00:17:58 UTC
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gur6ire3ulza7lhxtvqfck3k3hykxxjzkt7j6vcj7amwogpikhoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3523e4449ba2f20facf79d60512b6ad9f0abdd3954fe9f5449f8196719e851dd

(this sample)

AgentTesla

Executable exe 740937dc2e4ce55ffde8c557976b25715c76db9ee3d7dd0e8f866983575c8621

  
Dropping
MD5 389b2a8408076addebb74ff8ca904bd1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 740937dc2e4ce55ffde8c557976b25715c76db9ee3d7dd0e8f866983575c8621

Comments