MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86d7ebfb78eaaac727bbbc02a99d4e3e01fcbe2e8a4066bed43302aff9d0b205. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86d7ebfb78eaaac727bbbc02a99d4e3e01fcbe2e8a4066bed43302aff9d0b205
SHA3-384 hash: 169975db93b757d154bdf6ec25d266b49ade8c9f46ec8592531011cd57dc092fcdd270c99981559518efee46d444a2a9
SHA1 hash: 0312dd6274313e786856b633c0f5ebe7485bd75c
MD5 hash: 4e26567397f9f9b21701e5848fc57e7e
humanhash: sad-iowa-magazine-steak
File name:P0-2436567- Pdf.lzh
Download: download sample
Signature AgentTesla
Create hunting rule
File size:552'009 bytes
First seen:2020-08-31 08:25:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:FzdeKwRZmf8+Md8Bhuv7RZB0urOch9YUKUCnqaRWaO1Bk:FzdelXmfQSq0uaY9gquWamBk
TLSH 69C4239C6A7CF213E83933B835AB51EBF306B7E35E4D0547BCB8E50EC159411AA22167
Reporter abuse_ch
Tags:AgentTesla lzh Outlook


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: EUR04-DB3-obe.outbound.protection.outlook.com
Sending IP: 40.92.74.92
From: Aρετή Τζάνου <aretitzanou@hotmail.com>
Subject: Payment copy SWIFT
Attachment: P0-2436567- Pdf.lzh (contains "PLoLHKhSjefximh.exe")

AgentTesla SMTP exfil server:
roham.dnswebhost.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86d7ebfb78eaaac727bbbc02a99d4e3e01fcbe2e8a4066bed43302aff9d0b205/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q3l6x63y5kvmoj53xqbkthkohya7zprorjagnpwugmbk76oqwicq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/86d7ebfb78eaaac727bbbc02a99d4e3e01fcbe2e8a4066bed43302aff9d0b205

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 86d7ebfb78eaaac727bbbc02a99d4e3e01fcbe2e8a4066bed43302aff9d0b205

(this sample)

AgentTesla

Executable exe c629d160bf84cc6c4eeb8c7c74fda2ecf75006678017b6f004bc715fe92149ce

  
Dropping
MD5 d892bd57a4b6d24597bc10d9c92c1d12
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c629d160bf84cc6c4eeb8c7c74fda2ecf75006678017b6f004bc715fe92149ce

Comments