MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 906bc097130c34cbfb8bfe3031c302fd0ac2ecf1d608cf9677e17b458c72ec7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 906bc097130c34cbfb8bfe3031c302fd0ac2ecf1d608cf9677e17b458c72ec7c
SHA3-384 hash: 081bed81b45621b05dc95770ae1c8bb23acf77bab3479680c975b7d916f2c33c3e9e1b5ea42159658130416bab7edcff
SHA1 hash: 423c74fdd6ae3b7b694e9dd82b7cd16b4b7a4d2d
MD5 hash: 0788d39711ca584b4a42879ef8522263
humanhash: four-princess-gee-single
File name:Payment_Advice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:466'206 bytes
First seen:2020-05-28 06:06:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:SwgdKI9nhy6o5wGaN2RbXzWJZO2rUh4L/oFbp4y16SVhu5gLA7ogk5PBavxA3CBV:L6Uw1aXgZY6qH11VhGdS5PBaGrkBNa7+
TLSH A6A4231C8F4018F6B4354C3FB362623AED489DD905A9C97D2306140BAE93BADD9DB63D
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: supermedic.co.ug
Sending IP: 197.185.110.239
From: Account Controller <account.c@supermedic.co.ug>
Subject: FW: PAYMENT_ADVICE (103) 000OUTQ080519103
Attachment: Payment_Advice.zip (contains "Payment_Advice.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.20794.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 06:36:57 UTC
File Type:
Binary (Archive)
Extracted files:
294
AV detection:
32 of 48 (66.67%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 906bc097130c34cbfb8bfe3031c302fd0ac2ecf1d608cf9677e17b458c72ec7c

(this sample)

AgentTesla

Executable exe ee7bb1548fa55637eea3c95c32abe9d52bc0b51b560a1bc550d16e963d8606d0

  
Dropping
MD5 fdfbe4bcfb14fc79b7b8e9063f93ec2f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ee7bb1548fa55637eea3c95c32abe9d52bc0b51b560a1bc550d16e963d8606d0

Comments