MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 afe8e233175d2b0c680a10d846f253dc389820e8be55f002c4b1a42335830b90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: afe8e233175d2b0c680a10d846f253dc389820e8be55f002c4b1a42335830b90
SHA3-384 hash: 768081aed49e6997cdd06cc453b53d838620a5d93bf340ff8dbd7c7ab5936d3f6649d40f01e46973c159d23ee93e2f6c
SHA1 hash: dda8705950d0e719412c4089c164d9ac4a64cfb4
MD5 hash: ca32ff6a8d4dc8bc5230b188436f21b3
humanhash: xray-monkey-kilo-three
File name:DST261234.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'475 bytes
First seen:2020-07-16 10:08:19 UTC
Last seen:2020-08-12 07:58:59 UTC
File type: gz
MIME type:application/gzip
ssdeep 6144:j572fWV3ALt56fRIdQjNkSZVAqHrAn1dqC56kcFoypQCgSeXps16k2ymaaSvM0oj:j57kuomRSQX4R1dfLd21mXeM0oj
TLSH 8884230490A006C3E47D3538646F32A0E76A45E5A92DBFF4E6AA50CF8C15DCB68FC5BC
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: host.silver-phoenix500.com
Sending IP: 67.43.5.3
From: Librisa <librisa@mountnelson.co.za>
Subject: PAYMENT USD. 3,267.00 FOR DST261234
Attachment: DST261234.gz (contains "DST261234.exe")

AgentTesla SMTP exfil server:
mail.blackpearl-tours.com:587

Intelligence

File Origin
# of uploads :
3
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.16483.17290.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/afe8e233175d2b0c680a10d846f253dc389820e8be55f002c4b1a42335830b90/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 10:10:06 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v7uoemyxluvqy2akcdmen4st3q4jqihixzk7aawewgscgnmdboia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz afe8e233175d2b0c680a10d846f253dc389820e8be55f002c4b1a42335830b90

(this sample)

AgentTesla

Executable exe 24a00145d774f6aac5b11be0188c88f4b9485e626f464e94bb355db0e2ad0f93

  
Dropping
MD5 a5375147434baba2a3eb32606e9931b5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 24a00145d774f6aac5b11be0188c88f4b9485e626f464e94bb355db0e2ad0f93

Comments