MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37b7a1334c08f1cb8f2730c13986c1f24a29716ec227bd471b6a93a28a08daf1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37b7a1334c08f1cb8f2730c13986c1f24a29716ec227bd471b6a93a28a08daf1
SHA3-384 hash: 658e5d72d3394b7a59635543e25cb90f36c0b87870c6528308799f70fca78c9f50c4b212464ccd6f3e92f4c98031d944
SHA1 hash: 695584da475f25e16461cfe48d1d92cc119585af
MD5 hash: 70a93a5a734f2d248200f9e6268ea58f
humanhash: juliet-stream-india-utah
File name:Company Visit _Po Requirement.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:695'098 bytes
First seen:2020-07-21 07:07:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:wSLCMASYzWJk7/SBlXBCxv880A+ZxUPWi5w1bqSWodOWk4Y8yh+WyIoDEQm:xV9/6KBqK0PScp3+coDZm
TLSH 6DE4236EA9DB52D9C5D3003D0AD64226637DA1CBF7E2C9BAD9B5C728514C0B0C798EC3
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 142-4-11-112.webhostbox.net
Sending IP: 142.4.11.112
From: doccuments2@unique-collections.net
Subject: Purchase Order
Attachment: Company Visit _Po Requirement.arj (contains "Company Visit _Po Requirement.exe")

AgentTesla SMTP exfil server:
smtp.lebchrom.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37b7a1334c08f1cb8f2730c13986c1f24a29716ec227bd471b6a93a28a08daf1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 07:09:05 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g632cm2mbdy4xdzhgdattbwb6jfcs4loyit32ry3nkj2fcqi3lyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/37b7a1334c08f1cb8f2730c13986c1f24a29716ec227bd471b6a93a28a08daf1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 37b7a1334c08f1cb8f2730c13986c1f24a29716ec227bd471b6a93a28a08daf1

(this sample)

AgentTesla

Executable exe 566d75da52a7a8452233464bc0e22b5ee7242ccdc71cc8e518b76621eebe269f

  
Dropping
MD5 ce064009dd1da22fc208669e09ffed8d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 566d75da52a7a8452233464bc0e22b5ee7242ccdc71cc8e518b76621eebe269f

Comments