MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 623344972936ef938d926720ffe33dac5ff918a7e5bbab7aaca6611077e723b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 623344972936ef938d926720ffe33dac5ff918a7e5bbab7aaca6611077e723b1
SHA3-384 hash: fcded5627a94de2e0f87ded7b68fb4ad0e4682bb04dbe12be2d18b0c72096462b76f8972b923cfc17d5beb3a7499ae8d
SHA1 hash: f256499d7691013dc26f292076916ab68fcca95d
MD5 hash: 83a32fcd629d41912975dfee3da2e2b4
humanhash: triple-stream-music-lima
File name:po no 10389 10390.lzh
Download: download sample
Signature AgentTesla
Create hunting rule
File size:626'207 bytes
First seen:2020-08-16 18:11:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ue2xCIChmoOcBQ6vivDDS2YkKNy8ZIKvXb8Xl1BcB7h/Ov:r8ChmoOcK5FYRE8ZI2oXlzOh/Ov
TLSH 5FD4239E91E8087CDB340785750EDCD0D76C8C39E24B96518FCEB5AA1BDD3DE801BAA1
Reporter abuse_ch
Tags:AgentTesla lzh


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.allocatestorage.pro
Sending IP: 104.168.190.52
From: PETER LAZAROV <peter.lazarov@easyexport.bg>
Subject: Po procesada
Attachment: po no 10389 10390.lzh (contains "po no 10389 & 10390 - for 2 orders together.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/623344972936ef938d926720ffe33dac5ff918a7e5bbab7aaca6611077e723b1/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-08-16 18:13:07 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mizujfzjg3xzhdmsm4qp7yz5vrp7sgfh4w52w6vmuzqra57heoyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/623344972936ef938d926720ffe33dac5ff918a7e5bbab7aaca6611077e723b1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 623344972936ef938d926720ffe33dac5ff918a7e5bbab7aaca6611077e723b1

(this sample)

AgentTesla

Executable exe 37e399fce2caa80c9ea931f693b51a6d1c11464df1ead916cfca67f6100ad71f

  
Dropping
MD5 3e68b7ef28a3025b722831cd624cb2a8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 37e399fce2caa80c9ea931f693b51a6d1c11464df1ead916cfca67f6100ad71f

Comments