MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36b92fbe0dea81103d2fc68ae022f51a4e581349085f73d30accd7b8d4ec0355. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36b92fbe0dea81103d2fc68ae022f51a4e581349085f73d30accd7b8d4ec0355
SHA3-384 hash: bbcab875c882f475e6652822e117a1e0df9ad225bcfc835969b95e3ad98dabceb81cc05c5f77d19ba5ec18379d1493aa
SHA1 hash: f39a9b63631c1155f8437054ee04f2af8ddac7ad
MD5 hash: 09a6ffd055adefbd0754952afdccd449
humanhash: item-kitten-robin-sink
File name:INVOICE__900354.DOC.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:421'498 bytes
First seen:2020-06-18 06:01:27 UTC
Last seen:2020-06-18 06:34:47 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:I3SEQBfAxOIP2s172TlGk6Jr8eNXLuA/5Q1zTGTbzw96ydYTJvQRCH5+wwDg:Ix32kq8kCRNXLuk2Z4yUQRGf
TLSH 0D9423B101DE0DA8AD76C575E7EFDA09A78E19C4A815BE2C33617006FB837C15E183DA
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: talestra.mx
Sending IP: 209.58.149.65
From: Sales <yadira_gad@talestra.mx>
Subject: URGENT: Invoice overdue for May,28 (last month)
Attachment: INVOICE__900354.DOC.zip (contains "INVOICE__900354.DOC.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FakeAlert.9060.1798.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25805.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21146.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Worm.AutoRun
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 06:03:06 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g24s7pqn5karapjpy2foaixvdjhfqe2jbbpxhuykztl3rvhmankq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 36b92fbe0dea81103d2fc68ae022f51a4e581349085f73d30accd7b8d4ec0355

(this sample)

AgentTesla

Executable exe 36f23217058d61b401b63cfe41e8a7ccc1f5525a3f6b0c57800fda8403429fb6

  
Dropping
MD5 c48b23fd1e0da7af88cf2a26d7fae4c4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 36f23217058d61b401b63cfe41e8a7ccc1f5525a3f6b0c57800fda8403429fb6

Comments