MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48d8bcf972c3a967a18b8dbaca93f82d9c177b661c042f5963be7bd30c46c8b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48d8bcf972c3a967a18b8dbaca93f82d9c177b661c042f5963be7bd30c46c8b2
SHA3-384 hash: ff71d9367cbae0c640fbb08afbb246081cfa29f1174608825630823355f6af43edf6244284e1007f7f2efee649dd277b
SHA1 hash: 3a67bfde7ae873c998cbb1d3ca808575319b5d5e
MD5 hash: 2c94b467e9f55d11eba6e584290f5cb7
humanhash: oxygen-monkey-wisconsin-finch
File name:AL-ADAA106-REQUIRMENT.Gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'018'920 bytes
First seen:2020-06-11 12:21:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:P5KSY4K55s8j4LHx51LKUWWyJ3dnT5byv2zni2PTD0:l855LjSxeZJtTcv2Di2PTD0
TLSH 222533489DEAB99877514A72BC30CC52DEF7F1BB4296F65C5C80CA34383A8297171F86
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.228
From: Kassem Ahmed <office@jinpao.us>
Subject: Order for AL-ADAA Co
Attachment: AL-ADAA106-REQUIRMENT.Gz (contains "AL-ADAA106-REQUIRMENT.exe")

AgentTesla SMTP exfil server:
smtp.greenslr.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.AitInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 12:23:06 UTC
AV detection:
33 of 48 (68.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jdmlz6lsyouwpimlrw5mve7yfwobo63gdqcc6wldxz55gdcgzcza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 48d8bcf972c3a967a18b8dbaca93f82d9c177b661c042f5963be7bd30c46c8b2

(this sample)

AgentTesla

Executable exe ac6e23eef94b16aa7d6c2bdc35fa311bdf54019b2215d04b4e94384c4716ae84

  
Dropping
MD5 56d7ddb4351636c47f872dace62e9071
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ac6e23eef94b16aa7d6c2bdc35fa311bdf54019b2215d04b4e94384c4716ae84

Comments