MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 636e7dcd5d9ca0a0d90ef3769c2cf3d9e40cb9bdf824f9a01972f7695c793232. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 636e7dcd5d9ca0a0d90ef3769c2cf3d9e40cb9bdf824f9a01972f7695c793232
SHA3-384 hash: 0b03631828f985a4e285ca36fa7139398fff92931d2ada19d1f6e2204a4ca2fabd8247cf3c5fb597215a56db3923b59c
SHA1 hash: 4e4ae73c52fa98f4545c0d05064593cb2f85977a
MD5 hash: effa7010867607d5054dd734a4b11c84
humanhash: london-six-jersey-spaghetti
File name:PROFORMA INVOICE.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:697'895 bytes
First seen:2020-08-30 11:39:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:D49IxFHVX2ascYDPaRcGUMSQygVIA7LsRxsnCBaiu7kUEd0+UyCIkGxt2YRBZZVd:LPMPaRcGx4kLsRxsnCMv497vlH2yZZVd
TLSH 95E4333D522A2E32DF006043704FB745D1CAB0D5ADEEC53AB85693690F64A2D796EDF0
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: outbound-gw.openxchange.ahost.me
Sending IP: 94.136.40.163
From: danny@gms.scot
Reply-To: danny@gms.scot
Subject: PROFORMA INVOICE
Attachment: PROFORMA INVOICE.zip (contains "PROFORMA INVOICE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.6333.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/636e7dcd5d9ca0a0d90ef3769c2cf3d9e40cb9bdf824f9a01972f7695c793232/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mnxh3tk5tsqkbwio6n3jylht3hsazon57asptiazol3wsxdzgiza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/636e7dcd5d9ca0a0d90ef3769c2cf3d9e40cb9bdf824f9a01972f7695c793232

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 636e7dcd5d9ca0a0d90ef3769c2cf3d9e40cb9bdf824f9a01972f7695c793232

(this sample)

AgentTesla

Executable exe 6a5a84e5afd0a9d8fc62cacc992dc78ffc70fa1c72adfd2b6b7b415966a476cf

  
Dropping
MD5 ced74caeef36885026771e11a5aed446
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6a5a84e5afd0a9d8fc62cacc992dc78ffc70fa1c72adfd2b6b7b415966a476cf

Comments