MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae8df94daceac8f89a9c111f369a913db155558b016c3f2581e7961ac5234159. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae8df94daceac8f89a9c111f369a913db155558b016c3f2581e7961ac5234159
SHA3-384 hash: 8ca37a2c556868469893c2a0f35bf5d4d070369ee8c664950e9aecd141a0a92904454548829ba2678793633ffc41ea65
SHA1 hash: c9818708b69b3410036acf7b69d09b0727079280
MD5 hash: 9a9c6fa6e6c7d5ad829400534d44e90d
humanhash: triple-arizona-fourteen-berlin
File name:signed invoice.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:386'492 bytes
First seen:2020-06-16 13:00:36 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:oqfGBGKkrjP0lRRt2wO9ft+AOnxoXnz6/6YvS9BOWiF83ZyFGPeY0M0KtOb9gdQ:obBSrjY2wRAEf69BO3i3ZyFGbQ6OJR
TLSH 128423BC2943BEFE15521EBB0C69572EFB135EA5F82D06B81C21864F5CA871C3709A71
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 162-241-215-159.unifiedlayer.com
Sending IP: 162.241.215.159
From: Sam Chen <sam@cltcl.com>
Subject: RE: Signed Invoice
Attachment: signed invoice.7z (contains "signed invoice.exe")

AgentTesla SMTP exfil server:
montana.co.ke:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-06-16 13:02:05 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v2g7stnm5leprgu4ceptngurhwyvkvmlafwd6jmb46lbvrjdifmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z ae8df94daceac8f89a9c111f369a913db155558b016c3f2581e7961ac5234159

(this sample)

AgentTesla

Executable exe 205e511940812b0164b1b555125076af751fab06df540ce84ddc3a39e48aa28e

  
Dropping
MD5 df32c6ad1cc9b1d30074f8e65f3e326c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 205e511940812b0164b1b555125076af751fab06df540ce84ddc3a39e48aa28e

Comments