MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64d8051f2449d6089cc4bce1e13af8c74a07d4c07fdf45c7ef157bf18ea6a83f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64d8051f2449d6089cc4bce1e13af8c74a07d4c07fdf45c7ef157bf18ea6a83f
SHA3-384 hash: eec54da6c754d0e60f49c4146c5581175606eba4356e941b21a9288bde13135c01dfebbe720fa7d73285ed1850f91f9c
SHA1 hash: 2b52bb007ef9567d8182642fe3371bb6cd67a00a
MD5 hash: ebc76a90cf7ddecccce23ec3facf6b9f
humanhash: beryllium-triple-lithium-south
File name:proforma invoice.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:511'989 bytes
First seen:2020-08-30 08:55:52 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:2N5gNiAGZKBs8D0W3SB9e9qIgD+poAV9esiQNvtQuI:2MMAkWSe9nV9es9NvtZI
TLSH 33B42324A19A80C8E7C7DC7589BCE687918FC94CCCB2946565DF9913FACD2778B03AC4
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ceri.com.cn
Sending IP: 37.49.230.200
From: "Accounting Department" <lubo@ceri.com.cn>
Subject: 回复: RE: Deposit Payment
Attachment: proforma invoice.Z (contains "proforma invoice.exe")

AgentTesla SMTP exfil server:
mail.threewaystoharems.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/64d8051f2449d6089cc4bce1e13af8c74a07d4c07fdf45c7ef157bf18ea6a83f/
Threat name:
Win32.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2020-08-29 10:14:49 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mtmakhzejhlarhgextq6coxyy5fapvgap7pulr7pcv57ddvgva7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/64d8051f2449d6089cc4bce1e13af8c74a07d4c07fdf45c7ef157bf18ea6a83f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 64d8051f2449d6089cc4bce1e13af8c74a07d4c07fdf45c7ef157bf18ea6a83f

(this sample)

AgentTesla

Executable exe 5d7d5635f39243bf76aab83e1766066e9c3a024bdbcecf4dca14051e577efe4e

  
Dropping
MD5 e6338e5975ac79e4b333310f92b81c32
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5d7d5635f39243bf76aab83e1766066e9c3a024bdbcecf4dca14051e577efe4e

Comments