MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 853c65976f65bb35247cac6c3cbd816eb432c7f89d59c9752e60d14396fe2e56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 853c65976f65bb35247cac6c3cbd816eb432c7f89d59c9752e60d14396fe2e56
SHA3-384 hash: 03a196580b016c9d26548716c7cb0fb162fd9e18475febba882a1b5b3502837378d218c865e0fbb29a2190be5b81dd5b
SHA1 hash: cdbc328852104e9c4bb8b3a79b56671b67e4389c
MD5 hash: cc24bcb199d8ea80721d6bf60339bd30
humanhash: south-winner-september-social
File name:Scan copy.uu
Download: download sample
Signature AgentTesla
Create hunting rule
File size:405'037 bytes
First seen:2020-05-29 06:03:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:5a6e7qTUOCsoW5OODr1cn0vFnUO6+R3Ub5RafIDynKkC0FdeX52SDhcmRmprd29h:57e7qT7ZomOR4GUKPKIOc09SNBMd2v
TLSH 7C84238CD3C398F0D2BAE86A021168711DDA796A2477C1BB77EFED085720EEE17D6414
Reporter abuse_ch
Tags:AgentTesla uu


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vvillowood.com
Sending IP: 209.58.149.65
From: SON LEE < joan@vvillowood.com >
Subject: Payment Transfer
Attachment: Scan copy.uu (contains "Scan copy.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis16CC8DCE23BE.31699.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Malwarex
Create hunting rule
Status:
Suspicious
First seen:
2020-05-29 07:24:08 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
6 of 48 (12.50%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 853c65976f65bb35247cac6c3cbd816eb432c7f89d59c9752e60d14396fe2e56

(this sample)

AgentTesla

Executable exe 3bf4ccc4c163b1a1e8881a5c2d659e897c519eb6941a9faf1dc4a8b48cae7a2a

  
Dropping
MD5 16cc8dce23be27df1c9becb7f80625ca
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3bf4ccc4c163b1a1e8881a5c2d659e897c519eb6941a9faf1dc4a8b48cae7a2a

Comments