MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a354e72736a48872f69c01ee7b42f7a95efef3d396feb2b21612d0e411a59fe6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a354e72736a48872f69c01ee7b42f7a95efef3d396feb2b21612d0e411a59fe6
SHA3-384 hash: cba4f0b0f1a4011c6ba1ea11147705018206aba7b8aaaf5c1333e263382cff9c127e9fd01f6ca2180e18d31103202d6b
SHA1 hash: 8db5f988f3037b2755c32ee941999387f55c799f
MD5 hash: 7ec02d3cdb1d634123e39fc0bc4f0c49
humanhash: hotel-twelve-uranus-yellow
File name:P.O 6095-SAP.Gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:400'862 bytes
First seen:2020-06-30 08:46:54 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:fQwqSOeQeBG1OiLLHAOct43pbQY7x6sRlYSAcGRUVW8FZ7HR74PSoM:ofSOteBG1XLx44p3dRWnc0/8FZ7V4PSb
TLSH 5F842376B46C2BA88FB2FA03A7124A17D45787FCD455502299AECDE0FD399C1B8C1C26
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vega.awedns.com
Sending IP: 101.99.77.53
From: Elayaharasi <sales@global-mfg.com>
Reply-To: liangchiphlippines@gmail.com
Subject: Purchase Order No. 6095-SAP (Ref. No. 587-MCS-19).
Attachment: P.O 6095-SAP.Gz (contains "P.O 6095-SAP.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a354e72736a48872f69c01ee7b42f7a95efef3d396feb2b21612d0e411a59fe6/
Threat name:
ByteCode-MSIL.Trojan.Bluteal
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 08:48:09 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=unkoojzwusehf5u4ahxhwqxxvfpp546ts37lfmqwclioienft7ta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz a354e72736a48872f69c01ee7b42f7a95efef3d396feb2b21612d0e411a59fe6

(this sample)

AgentTesla

Executable exe 30b7dc7fc3a1a6a1d122b254cd8bcb0df765949737d6936655405aa7a05ae987

  
Dropping
MD5 52b0f50f982b9ba3a33d559d4928bf57
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 30b7dc7fc3a1a6a1d122b254cd8bcb0df765949737d6936655405aa7a05ae987

Comments