MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4b6369d1dc14fbe5478bb2d356b6c9777e84578a10e76387203a326cd747ca1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4b6369d1dc14fbe5478bb2d356b6c9777e84578a10e76387203a326cd747ca1
SHA3-384 hash: 0a7ff37ab53f02fee591639c133d5432cc88c5162b848afe4e800d51a737052bc0fb692553d775ff1fe8a85d48517d99
SHA1 hash: eff073d807a98986e66db4e48f1cd562f47d864e
MD5 hash: 3a2d2819e862b136fe113333c1270eac
humanhash: mountain-carbon-fifteen-mockingbird
File name:PO copy.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:395'277 bytes
First seen:2020-05-13 11:03:54 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:PAlGtLiXLtbT7mtHdl5naIVPDTGLvw868:IQtLgL1709l9aIBTGcV8
TLSH 388423A3A2F75F57E386372FC21BD02818C058738136D86DAA524F712D537EE2361AB4
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: yandex.ru
Sending IP: 95.211.208.58
From: Export Department<ac.general@yandex.ru>
Subject: Urgent Request for Invoice
Attachment: PO copy.pdf.z (contains "PO copy.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 11:37:11 UTC
File Type:
Binary (Archive)
Extracted files:
266
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=us3dnhi5yfh34vdyxmwtk23ms536qrlyuehhmodsaorsntlupsqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z a4b6369d1dc14fbe5478bb2d356b6c9777e84578a10e76387203a326cd747ca1

(this sample)

AgentTesla

Executable exe 6519dfe26997fc43ff02521a72567a3477dfcee8dbdfeaf35253b30cb07d12af

  
Dropping
MD5 ab2ea9050e15c1b1c7a7c71cb65fd0de
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6519dfe26997fc43ff02521a72567a3477dfcee8dbdfeaf35253b30cb07d12af

Comments