MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4de96a08c84b774dcb873641d8b85fe1b1b0e4f1b97b905e111113c2d32c1343. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4de96a08c84b774dcb873641d8b85fe1b1b0e4f1b97b905e111113c2d32c1343
SHA3-384 hash: 6ad28f12cc2b9f3a5985e0853017ab14aeb7f9a459182f70fe38f352670eaab4ed94bdab77904cf42571199d38aee9da
SHA1 hash: 8194ce887f41bb79d05030c7815c4246ca8a2ba2
MD5 hash: b7173434ea8e3c700a8b0af4097edaaa
humanhash: magazine-uncle-blue-low
File name:Please provide EURO1 Draft.jkj.pdf
Download: download sample
Signature AgentTesla
Create hunting rule
File size:415'479 bytes
First seen:2020-06-19 13:44:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:viLz2NpO0h3r5FHzEiVqMI3kQ5hnUX4N2Fbo:viLSNh3nHwiVqGmUX4NJ
TLSH 1894235C32BB1169C8E5D7112A17095170F3FFBBB49132BCA0FA64FBB1D848664BAE05
Reporter abuse_ch
Tags:AgentTesla pdf


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: safetyegypt.com
Sending IP: 209.58.149.66
From: Iman<Imandraz@safetyegypt.com>
Subject: New order number PO 123-06/20
Attachment: Please provide EURO1 Draft.jkj.pdf (contains "Please provide EURO1 Draft.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-19 13:46:05 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jxuwucgijn3u3s4hgza5roc74gy3bzhrxf5zaxqrcej4fuzmcnbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 4de96a08c84b774dcb873641d8b85fe1b1b0e4f1b97b905e111113c2d32c1343

(this sample)

AgentTesla

Executable exe b1b0b814086ceb3cbe9b931ca3ac14ed934399c35b4b6ce956f98e50ea3186ef

  
Dropping
MD5 423c65948e1fe9c4390314f6cebe66d9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b1b0b814086ceb3cbe9b931ca3ac14ed934399c35b4b6ce956f98e50ea3186ef

Comments