MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4673d9b7f7df2763c4b8d96cc777b52fbe7705a8acb2b03a7eb9958ea16b327e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4673d9b7f7df2763c4b8d96cc777b52fbe7705a8acb2b03a7eb9958ea16b327e
SHA3-384 hash: ef9bc0ed892a4a67ba964b0f5660dd94366a4296cdcb549c177a224cb21c74be952f5c00a84de07b2cd9092fb1f9b215
SHA1 hash: 918112ca0b9e051ebfc02c178f539c27167ca5e5
MD5 hash: 2ab288d6b1f21d5ca50be982b0b2b008
humanhash: earth-twenty-virginia-harry
File name:Scan docs.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:678'068 bytes
First seen:2020-08-18 07:32:16 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:mFWcL2/V+MbDoP8mVIoGPI5bSAFhlDrHggH8TkpJ4NTSQTeQxoK75TBxgKYFUEE1:ubaN+MQP8m4A5bSA5fzmmQThxoKvGdFq
TLSH 13E4231DA6E48C6A325E0C9FE2E0601DCE4756D61676BFE174629A4BB0CBDDCC0D03B6
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gw.vietinaviva.vn
Sending IP: 42.112.208.197
From: TRUONG THI HIEN TRANG <truongthihientrang@sales.aviva.com.vn>
Subject: Payment Sent T/T Receipt Attached - Overdue Invoices Payment
Attachment: Scan docs.rar (contains "Scan docs.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4673d9b7f7df2763c4b8d96cc777b52fbe7705a8acb2b03a7eb9958ea16b327e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 07:34:08 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=izz5tn7x34twhrfy3fwmo55vf67hobnivszlaot6xgky5illgj7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 4673d9b7f7df2763c4b8d96cc777b52fbe7705a8acb2b03a7eb9958ea16b327e

(this sample)

AgentTesla

Executable exe dbc161933aaec1f13250088d9923431b800c6b1dac117c4fbbe834c43b0b441b

  
Dropping
MD5 8f38e010c6a00fea313143b862eef04c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dbc161933aaec1f13250088d9923431b800c6b1dac117c4fbbe834c43b0b441b

Comments