MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c9b2ac9186158cddca77ae58b415445491079f3721b1126f2f7d30a32913e80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4c9b2ac9186158cddca77ae58b415445491079f3721b1126f2f7d30a32913e80
SHA3-384 hash: 9f53c84114565e3b3c30f2076fe66911735fc4afe9062b1585962d9b190f87ea9d59ef1155ed0cab96b41b4dd17dbf58
SHA1 hash: d6c5e6943e1accb9e993fbc0cf6a1929d61e21a0
MD5 hash: 890fd7baad5fcc9ff7e72e3aa39ae070
humanhash: table-enemy-mississippi-september
File name:GEA_5556789.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:982'519 bytes
First seen:2020-06-16 05:43:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:VshqeNdegL2M6FegHU4ETrFM7fjohoeX2gb7nf0qoX:VdeFLEQg04EMfjohXXnfgX
TLSH CF2533B66D35882D373C79A28C210CB6D161B84EA750730E6D93E68E53CE2DD46C4B77
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pdlc34160.ciberserver.com
Sending IP: 176.221.34.160
From: Miss. Marie Palmero <opr6.ae@absaco.com>
Subject: DELIVERY ORDER
Attachment: GEA_5556789.zip (contains "GEA_5556789")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Script-AutoIt.Trojan.AitInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:45:05 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jsnsvsiymfmm3xfhplsywqkuivera6ptoinrcjxs67jqumurh2aa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4c9b2ac9186158cddca77ae58b415445491079f3721b1126f2f7d30a32913e80

(this sample)

AgentTesla

Executable exe b4a49ab94a3bc704c6eb3394df82ebae6e04dd139a765db41db66e65457b0673

  
Dropping
MD5 f27fed1c7cb331f04fdcfecedc899c7d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b4a49ab94a3bc704c6eb3394df82ebae6e04dd139a765db41db66e65457b0673

Comments