MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ade494362402a793b745a3a7857ff5c779dfef4e931e8e05078f6b8a97c71284. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ade494362402a793b745a3a7857ff5c779dfef4e931e8e05078f6b8a97c71284
SHA3-384 hash: d9eaa89b5d3970feed596a134682108e11f4dc471f351f57cd905cd62bee18b318f256cdcf8a2a96e79dee8de78d3da9
SHA1 hash: 4dac1f5d3c490be0f09e0b8d98512957759d41b0
MD5 hash: 3385856849ba0ad5f5561b4039a995cc
humanhash: wolfram-emma-alabama-pip
File name:QJIAYB93BC939XO.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:333'400 bytes
First seen:2020-07-21 07:41:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:yrlFv93RM1zmQqM/T6Qu8hHS6uL15j/PPMj3/JfNY8Pqc8jN7tv+t2lD2rl8OQBf:yrr5RAzfqQT3HS6uhZPPe/JFjqzjN7tb
TLSH CF642361CBE06D204F7D4D683336C5B629BED589F64AC3CDC9B8A06DF8C95B506F084A
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.betalt.lt
Sending IP: 86.38.169.85
From: predaj <predaj@mgmauto.sk>
Reply-To: predaj <Standardchartered22121@outlook.com>, predaj <Standardchartered22121@outlook.com>
Subject: tovar poškodený
Attachment: QJIAYB93BC939XO.7z (contains "QJIAYB93BC939XO.exe")

AgentTesla SMTP exfil server:
mail.amazinghotel.com.vn:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ade494362402a793b745a3a7857ff5c779dfef4e931e8e05078f6b8a97c71284/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 07:43:06 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vxsjinreaktzhn2fuotyk77vy545732osmpi4bihr5vyvf6hckca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ade494362402a793b745a3a7857ff5c779dfef4e931e8e05078f6b8a97c71284

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ade494362402a793b745a3a7857ff5c779dfef4e931e8e05078f6b8a97c71284

(this sample)

AgentTesla

Executable exe f6a1e6d11e0366c52fea294e6010a96df682e42df3a9d4fc417ae755366e91e2

  
Dropping
MD5 391d98e696ef46d06a60903a91cae10e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f6a1e6d11e0366c52fea294e6010a96df682e42df3a9d4fc417ae755366e91e2

Comments