MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4854ed4de224321bd425305d4d54bfd97850e5aceb45956a4ded4e800bb67333. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4854ed4de224321bd425305d4d54bfd97850e5aceb45956a4ded4e800bb67333
SHA3-384 hash: 05ab2ebe6917bb7d6c94c7b9ab47878f9df591ad01bad5cc32fbbc221778121abff782c60103b0b535f10215e9c3e0b7
SHA1 hash: 3651486d23dca237e91949afb44ddbab21acbb20
MD5 hash: 620cc8bfdae12de03f096f63db4e4f96
humanhash: georgia-twenty-december-moon
File name:payment copy.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:533'848 bytes
First seen:2020-05-08 18:24:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:gPn6Szwwor7r2SktAOT8zPCYud5OrRQNt9EZ2OY7uPHeSsRPaUt65:gyS8woHrJktdT8zydUZ2OYiPHDsRP/K
TLSH DAB4238F65B6E0A4F541D84D48B1948BFE128DD9CAE9F9B1711ECDCC46B1BE1321D3A0
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: brydens.com
Sending IP: 156.96.45.195
From: account. Department<account@brydens.com>
Subject: payment confirmation.
Attachment: payment copy.pdf.zip (contains "payment copy.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Rdn
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 18:35:30 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jbko2tpceqzbxvbfgbou2vf73f4fbznm5nczk2sn5vhiac5womzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4854ed4de224321bd425305d4d54bfd97850e5aceb45956a4ded4e800bb67333

(this sample)

AgentTesla

Executable exe 9f124b201243a16323689f45e0faacac2ed9f77f748b0b69045fea2c3acfaa72

  
Dropping
MD5 a3de29f96c57deabbdb90fa21f3b5290
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9f124b201243a16323689f45e0faacac2ed9f77f748b0b69045fea2c3acfaa72

Comments