MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5146252b3bd79848c037ffa3fce75f3bd1307de6da5d74633f04a7c14eaae327. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5146252b3bd79848c037ffa3fce75f3bd1307de6da5d74633f04a7c14eaae327
SHA3-384 hash: 4f842a70fc092a89b114b14a3139fc20abfd159ac3bcd3d11172c406408bbcaa7562571e2331474db485de0197d49b20
SHA1 hash: 0fe59e9b566bfdbd89be36a9eca74b49585c6e4d
MD5 hash: 1474f25f31bf968c22af05827e2a82c9
humanhash: charlie-steak-vegan-louisiana
File name:INVOICE.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:374'960 bytes
First seen:2020-06-21 07:07:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:SstoIpVc/VjrQNBl4W4tKf54XmxWQzAGY45swP4VTtCcVrpvfUTvUewEs:Sso5/VfOBx4twCmxpAdd5VZCQ40
TLSH D98423ECF5A574B653BBA10042374591B38A0EBEF4BC16D2633979C16FF2B23474AA05
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: postalgaspetenergy.net
Sending IP: 139.28.38.208
From: Ibrahem <ibrahem@ablhasn.com>
Subject: Kindly Review our new invoice
Attachment: INVOICE.zip (contains "INVOICE.exe")

AgentTesla SMTP exfil server:
smtp.ionos.es:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22125.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-21 07:09:04 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kfdckkz326merqbx76r7zz27hpita7pg3joxiyz7ast4ctvk4mtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5146252b3bd79848c037ffa3fce75f3bd1307de6da5d74633f04a7c14eaae327

(this sample)

AgentTesla

Executable exe 35674b4265d6867b51942dbc6113f0c5eaf080a366d1092325db974289a85f9c

  
Dropping
MD5 1029723ac6d3a38214c124fb14b24357
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 35674b4265d6867b51942dbc6113f0c5eaf080a366d1092325db974289a85f9c

Comments