MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 767a4fed81e0d2b5605ed8a42b4f504b4bff6a294cfeb05e1342ddb6a16360dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 767a4fed81e0d2b5605ed8a42b4f504b4bff6a294cfeb05e1342ddb6a16360dc
SHA3-384 hash: 726e95fe3811d0a3a8e91ee8707a358c727df9c406af87a82c403d9bad28cafa2540e0594cba2bf84ee3dbf29c193c65
SHA1 hash: 44bcb343126ccaf63198584ca15fa141987739e6
MD5 hash: 48c593035eb4517cd4378fa12a44ad71
humanhash: oscar-eleven-papa-fillet
File name:p9Xgnuhx4tNRjsE.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:513'624 bytes
First seen:2020-08-19 13:03:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:KTuomzBnr8gplZYruVtEbat5VykxcwMZhQGKLCg2/C:bomzBnrhzZ8qtEbatDykFMZChCgP
TLSH 22B423B10B2D58548C7EA5AD928ADAF876251FC56371B0B33F09C6C396608DB0F06AC7
Reporter abuse_ch
Tags:AgentTesla ESP geo xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: fimaksplastik.com
Sending IP: 185.222.57.209
From: NAFTEX<export@fimaksplastik.com>
Subject: Fwd: Pago del saldo de PO3153485
Attachment: p9Xgnuhx4tNRjsE.xz (contains "p9Xgnuhx4tNRjsE.exe")

AgentTesla SMTP exfil server:
srvc13.turhost.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.405.5521.29094.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/767a4fed81e0d2b5605ed8a42b4f504b4bff6a294cfeb05e1342ddb6a16360dc/
Threat name:
ByteCode-MSIL.Trojan.Sudloader
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 13:05:10 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oz5e73mb4djlkyc63cscwt2qjnf762rjjt7laxqtilo3nildmdoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/767a4fed81e0d2b5605ed8a42b4f504b4bff6a294cfeb05e1342ddb6a16360dc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 767a4fed81e0d2b5605ed8a42b4f504b4bff6a294cfeb05e1342ddb6a16360dc

(this sample)

AgentTesla

Executable exe a52df6fbfa534f162855c39194591cbafef749a4c24a0d3c1dc80c1125453f26

  
Dropping
MD5 a2415c6836e64fc1c9ed53febcff620e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a52df6fbfa534f162855c39194591cbafef749a4c24a0d3c1dc80c1125453f26

Comments