MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46b22817f78896ad4223a8813c8a7fc6a352bff52be43b5644c865486de95556. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46b22817f78896ad4223a8813c8a7fc6a352bff52be43b5644c865486de95556
SHA3-384 hash: 08c52e255d5610959babf50b43e6fac0e94121b640c79bfc6d4b108e147039f39f9db6b289ff6afbdb9ac10ce7d5fdb9
SHA1 hash: 45599b257298b82702ef62143d400e0c37643757
MD5 hash: 33bbdc92d5caf18047ef315658d0b1b9
humanhash: mobile-five-bluebird-chicken
File name:Plistan86Pem3.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:367'195 bytes
First seen:2020-07-07 18:31:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:nXFZogSDNjUWqPOr2qGV5BsaNOfVtWp6BcLS2VVitPs3qt5j9z30sY:nXMFDZqPNvYaYfLWc7AV+xtQsY
TLSH 557423B25F0C1AF638E51A1FB42501BDCEB5E1CD53E1A2709A49E7D0A3CC56A7EC4863
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: correo2-empr02.hpservidor.com
Sending IP: 69.167.174.59
From: Junieth Escoto <contabilidad@germsa.com>
Subject: Give us promotional price
Attachment: Plistan86Pem3.rar (contains "Plistan86Pem3#.exe")

AgentTesla FTP exfil server:
ftp.ciftci.com.tr:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46b22817f78896ad4223a8813c8a7fc6a352bff52be43b5644c865486de95556/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 18:33:04 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i2zcqf7xrclk2qrdvcatzct7y2rvfp7vfpsdwvsezbsuq3pjkvla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 46b22817f78896ad4223a8813c8a7fc6a352bff52be43b5644c865486de95556

(this sample)

AgentTesla

Executable exe 0137e0e90dcb38e88138add7478e567f93fef19512df0f1e166940696b790b7c

  
Dropping
MD5 5f75df0152f83309cc8cd60b8efd8c62
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0137e0e90dcb38e88138add7478e567f93fef19512df0f1e166940696b790b7c

Comments