MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 677af94bd1064fd89adf4b87a0e0159b8e448fb92265f30b6a09b60617df5b02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 677af94bd1064fd89adf4b87a0e0159b8e448fb92265f30b6a09b60617df5b02
SHA3-384 hash: 82f8d537d0c4b8428b5db18d3b57b53cf47479b251e0304dc5fd309e5cfb6359b44bf9d1ccc2f18d553cf5112ab2e2e8
SHA1 hash: d4d12dfb54da69db6d87605e4c012658ef7f9654
MD5 hash: 64ee8511c1eab3e5fc5d8c9b612c065f
humanhash: violet-five-fifteen-fanta
File name:NEFT Payment Receipt.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:449'494 bytes
First seen:2020-06-25 09:37:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Ggc8IYvdaOC8DkuKO+xNeUJmh3D3bGauUctqMoMrI/qG1R:G2vnwssN2/s18MQ/PR
TLSH 06A423C8415D0B0BD655BCF084E9B95973F4DBC2F2FAC61C25AEEA704A54E972209B3C
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gmail.com
Sending IP: 103.99.1.145
From: SHAMBHAVI LOGISTICS<shamnbhavilgistics@gmail.com>
Subject: NEFT Payment Receipt for releasing Container (1*40') , a/c Kapoor & Co.
Attachment: NEFT Payment Receipt.zip (contains "NEFT Payment Receipt.exe")

AgentTesla SMTP exfil server:
mail.pro-powersourcing.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.44022.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/677af94bd1064fd89adf4b87a0e0159b8e448fb92265f30b6a09b60617df5b02/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m55pss6razh5rgw7jod2byavtohejd5zejs7gc3kbg3amf67lmba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 677af94bd1064fd89adf4b87a0e0159b8e448fb92265f30b6a09b60617df5b02

(this sample)

AgentTesla

Executable exe 590d32924480f6d5306978feb7fea108eebfea73a42f50f7e06ddd7dd6db9269

  
Dropping
MD5 db56d94b3df3bead6e010931aa0d379d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 590d32924480f6d5306978feb7fea108eebfea73a42f50f7e06ddd7dd6db9269

Comments