MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2fb596b0522d34c996c19f888d5fb6f22fc67ab98a323ed6f40533bfb62275f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2fb596b0522d34c996c19f888d5fb6f22fc67ab98a323ed6f40533bfb62275f
SHA3-384 hash: f5f0985be46763facb298e978106ba05fadb0295cb8c7eb94bd7935108bc8682dded41552df6204496c629b95bf0bb15
SHA1 hash: 90f6081944a785a57bf106380f2fdb36f6efb610
MD5 hash: 8a6b23ad143fcaf9c71337e8f003cd61
humanhash: stairway-texas-uniform-oranges
File name:NOVO NALOG 495-CZ8540-pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'023'762 bytes
First seen:2020-05-26 10:31:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:4UmgOUJse2050w7DL7WXHdgsDMWKHR4PuQNa6oH7Qs6:4jUA4pWHdgsQjH2ro89
TLSH 6B25337DDCAD4F1A4D257B20EEC2B544F37BBBE090B68A01E6F2234D229471C55276A3
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: potassium.studio4web.com
Sending IP: 138.201.253.91
From: Robert Sendra <robertsendra@arkoslight.com>
Reply-To: Robert Sendra <dustiutd12@hotmail.com>
Subject: ZAHTJEV ZA PONUDU
Attachment: NOVO NALOG 495-CZ8540-pdf.7z (contains "NOVO NALOG #495-CZ8540-pdf.exe")

AgentTesla FTP exfil server:
ftp.kassohome.com.tr:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 12:58:39 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a2fb596b0522d34c996c19f888d5fb6f22fc67ab98a323ed6f40533bfb62275f

(this sample)

AgentTesla

Executable exe 481f6c65b203c8c720e2b80c229029552bae336eb24ec5e5babae6fd9eb6802b

  
Dropping
MD5 94d86595a2c02ffe559d8c5f2fa58a56
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 481f6c65b203c8c720e2b80c229029552bae336eb24ec5e5babae6fd9eb6802b

Comments