MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76a49b3b9e17f8bf8bad9b3d3f429c1f38cec326b645e767f49cf60b0e5a8d14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76a49b3b9e17f8bf8bad9b3d3f429c1f38cec326b645e767f49cf60b0e5a8d14
SHA3-384 hash: 955e3d8f0879b99fb622779d6a7714b02315275238eacd0ad7cb5b7a7586adc18b23b3b1780cf8954c06f3cffb6b7e75
SHA1 hash: b562edb99de1f0b75c7c0c1bdc5fd393a4c446f5
MD5 hash: 6f1e3c2a0807ccebc2879985aa19fa3d
humanhash: romeo-low-hydrogen-hamper
File name:payment advice is issued.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:414'189 bytes
First seen:2020-05-24 07:00:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:dfcOHI2NLUt7z2gmwWSAdgaOM95SXSZgrHemfAV:dfcOHNNQzvfKbZgrFfAV
TLSH AB9423EF8EC6D767825D025AAF8A123278627EE360149191F382EC54E5ACD24DDF8C74
Reporter abuse_ch
Tags:AgentTesla HSBC zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 23.226.135.108.static.quadranet.com
Sending IP: 23.226.135.108
From: HSBC Advising Service <advising.service.9675976.771724.2434662806@mail.hsbcnet.hsbc.com>
Subject: Payment Advice - Advice Ref:[GLV908109269] / Priority payment / Customer Ref:[UNMATCHED]
Attachment: payment advice is issued.zip (contains "payment advice is issued.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-24 01:26:31 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
16 of 47 (34.04%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 76a49b3b9e17f8bf8bad9b3d3f429c1f38cec326b645e767f49cf60b0e5a8d14

(this sample)

AgentTesla

Executable exe fc44a6e861843ed0dca54174a5257b83c1e883eeecb13bd841f779c0aede0626

  
Dropping
MD5 5def6bbe6b69d1646b6e00fc1f82f1a5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fc44a6e861843ed0dca54174a5257b83c1e883eeecb13bd841f779c0aede0626

Comments