MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4c4bc3a17d10b85e30f3e327992173ffc1d9cebdff1ac6a616b73f1de2daf99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4c4bc3a17d10b85e30f3e327992173ffc1d9cebdff1ac6a616b73f1de2daf99
SHA3-384 hash: b3c5300e1f7c3bb92bab6d957781cb4266ba1a498e79d9e837c18a941f9df34fccc268b6c1f9aa01e5914ce5e43eabe1
SHA1 hash: bbb35c09b5572da391ed1ca2196016cfb3e6e9cf
MD5 hash: 32426637bb954651e7765e75054e5be1
humanhash: pennsylvania-cat-low-fourteen
File name:Case file3454.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:437'394 bytes
First seen:2020-06-25 12:44:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:qlotTkBnobKL/0biyr9Id8ev1Gz3Oq/94Ku84jDW:LtTkab20biyr9M81hru8UW
TLSH D194231E6D80276A0EC8DE81ABE794905BB075B2C201209F51C7C3BEA67DB9F747C617
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gmail.com
Sending IP: 37.49.224.4
From: High Court<fhc243@gmail.com>
Subject: Case file
Attachment: Case file3454.zip (contains "Case file345[4.exe")

AgentTesla SMTP exfil server:
smtp.bnb-spa.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.181bf63f744587d9.5579.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23110.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4c4bc3a17d10b85e30f3e327992173ffc1d9cebdff1ac6a616b73f1de2daf99/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 13:53:43 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=utclyoqx2efylyyphyzhteqxh76b3hhl37y2y2tbnnz7dxrnv6mq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a4c4bc3a17d10b85e30f3e327992173ffc1d9cebdff1ac6a616b73f1de2daf99

(this sample)

AgentTesla

Executable exe 4f598ea6387a29de4822b3fa232f0d8e1c0b6ddb3cac0a3c12a624873be4705b

  
Dropping
MD5 f1a1846759d6f9f0a73d9c4c80311dc1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4f598ea6387a29de4822b3fa232f0d8e1c0b6ddb3cac0a3c12a624873be4705b

Comments