MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a343469bc3f2bd2bba2dd45f4ec1a62e735491fc6a0b5dbaa3ab23c4e64841f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a343469bc3f2bd2bba2dd45f4ec1a62e735491fc6a0b5dbaa3ab23c4e64841f0
SHA3-384 hash: 9888141e0660860c7d1b5436dfdc9cc9c8fcebaf5ad82d068d0c1e79988dbe41bd77366ee627714ede2d71a834031103
SHA1 hash: 2c0c971ab5cd5475cdceb1f5790c73a30596b5ed
MD5 hash: 534af742477fccd85ee6ba7b5bc86db3
humanhash: nevada-bulldog-social-virginia
File name:Draft Contract.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:419'955 bytes
First seen:2020-05-14 07:34:11 UTC
Last seen:2020-05-14 18:56:43 UTC
File type: gz
MIME type:application/x-rar
ssdeep 6144:pr3KdSXyZz/qclYQ1qPqfbsTppNk/jr5fh0P868FcDXeg9rrBAr3tRbOIc9hmy5p:ZHCZzdlYZ8KpCPUP834D9ryLtk59QWb
TLSH EC94235D8D4F334B89424AE2E731D83E5F5D8CA69FA556BFC8E8710AAF11E65D2038C0
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: tsaishin.com.tw
Sending IP: 103.145.253.9
From: Anthony Hwang <info@tsaishin.com.tw>
Subject: RE: Draft Contract of 1-8 Shipment
Attachment: Draft Contract.gz (contains "Draft Contract.exe")

AgentTesla SMTP exfil server:
mail.scandinavian-collection.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 07:36:54 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=unbung6d6k6sxorn2rpu5qngfzzvjep4nifv3ovdvmr4jzsiihya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz a343469bc3f2bd2bba2dd45f4ec1a62e735491fc6a0b5dbaa3ab23c4e64841f0

(this sample)

AgentTesla

Executable exe 15dee864e14a92f65233de4dbb94d96fbdd2043c447159fcea5f88e5489bc302

  
Dropping
MD5 98bd5bb185f07c9d7c52f25b2f466e25
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 15dee864e14a92f65233de4dbb94d96fbdd2043c447159fcea5f88e5489bc302

Comments