MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35c927586200f4cf9399798d45aedbc83606ac8b8376ec89cf326b8113664cbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35c927586200f4cf9399798d45aedbc83606ac8b8376ec89cf326b8113664cbd
SHA3-384 hash: 8701eea13fed142fab481e6cf948ec074c751dda4934b4a3ede7d646d651b2bf3e3ba03da733404d7415550d4eb261f3
SHA1 hash: 375559d1e045c5f15580d679966dfd223f9b1a65
MD5 hash: a2623f9c94c3a2289fd0c0e597da91ed
humanhash: ten-apart-may-moon
File name:STATEMENT OF ACCOUNT _pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:400'991 bytes
First seen:2020-05-21 15:50:00 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:HsloWilsKpn9YnyqFjYl6cFeoLcm1GcBm51lJ:uoWiFpn4yqFcl6cisslJ
TLSH 048423711C89353F2A3712C08591019968F49AEFFCB893E051D80266E43E9FD7E7DAAD
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps32368.inmotionhosting.com
Sending IP: 104.247.78.88
From: leenap@jamesrbaker.com
Subject: STATEMENT OF ACCOUNT
Attachment: STATEMENT OF ACCOUNT _pdf.gz (contains "Payment Copy_pdf.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 21:44:00 UTC
File Type:
Binary (Archive)
Extracted files:
295
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 35c927586200f4cf9399798d45aedbc83606ac8b8376ec89cf326b8113664cbd

(this sample)

AgentTesla

Executable exe 81e1b005ad6288e3342303bb5f923ac974cd409220848cb371c0fdac7f7af6a4

  
Dropping
MD5 fc5dbe94aed5ace1dfe2b09dd776ba78
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 81e1b005ad6288e3342303bb5f923ac974cd409220848cb371c0fdac7f7af6a4

Comments