MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b04dc35a8144fff2f2506da1a61471a505f84832545c96bd2e2d3d741a2eafb1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b04dc35a8144fff2f2506da1a61471a505f84832545c96bd2e2d3d741a2eafb1
SHA3-384 hash: a07ce5fed38a31c6c23830bbffcc0d8af3be5962641be5f105c6f79c42c826ba23c98aebbe6b8ff72c683d72853e1464
SHA1 hash: 987ccf65c32c365028d1f6bb6ef41a20ed9e068a
MD5 hash: d206a1ea8494b65cc919fd2d816b443a
humanhash: paris-arizona-one-hydrogen
File name:Terms Conditions.pdf 2.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:419'538 bytes
First seen:2020-05-11 14:40:00 UTC
Last seen:2020-05-12 12:59:26 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:AyKkqSB+UY1vqD3WKPJdXXG6445C7n8dEjfWN9U:AyMSIUvD3PXGNn8dEjfWNS
TLSH 3194233C7A7D4F4CE96434FCD778F830BE8EF9152629A3B9DC961488A090D179816DA2
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: zoolibri.com
Sending IP: 103.99.1.174
From: Press<press@zoolibri.com>
Subject: LEGAL ACTION ON YOUR COMPANY FOR LONG OVERDUE INVOICE
Attachment: Terms Conditions.pdf 2.zip (contains "Swiq7jfYQ3Wi3x8.exe")

AgentTesla SMTP exfil server:
mail.cpworldindia.com:587

Intelligence

File Origin
# of uploads :
6
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48635.28055.32326.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 10:41:18 UTC
AV detection:
14 of 31 (45.16%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wbg4gwubit77f4sqnwq2mfdruuc7qsbskrojnpjofu6xigrov6yq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b04dc35a8144fff2f2506da1a61471a505f84832545c96bd2e2d3d741a2eafb1

(this sample)

AgentTesla

Executable exe 3168af462696c8edf2bb2ab1537782ca60135573d977c6d3264ca2069871d9b5

  
Dropping
MD5 a6acb89b4a2941b7060b006034447d96
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3168af462696c8edf2bb2ab1537782ca60135573d977c6d3264ca2069871d9b5

Comments