MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b37950e9376965942f8dddc16f447d9b93c7c286917c9371b0e83d06f7700bbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b37950e9376965942f8dddc16f447d9b93c7c286917c9371b0e83d06f7700bbc
SHA3-384 hash: 71a8edf7f9cddc4b03bc1a9c028c0d1ce46bc5441b06750f6d567f46e1d44abc38da7a69b05fc12576eb0489dff599ce
SHA1 hash: c104ea294467fc2f06f25831add612ec331d1b74
MD5 hash: 93121dc283326135820472935dfbef7c
humanhash: tennis-kitten-carbon-georgia
File name:Documents.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:492'253 bytes
First seen:2020-06-10 17:55:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:lc5MXUEK0cA/uJtURERdnTbaW7gEYwB7hnbBkX3:lc5MkXJtbdnnHB7V+n
TLSH DBA423E5B8162AB6484DC2EE180ADA659759338205E4E7863F1F2D07EFE195346C2F33
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: magna-systems.com
Sending IP: 45.90.222.93
From: Silva David <harin@magna-systems.com>
Subject: Corrected documents for your approval
Attachment: Documents.zip (contains "Documents.exe")

AgentTesla SMTP exfil server:
smtp.1and1.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.24904.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wn4vb2jxnfszil4n3xaw6rd5toj4pqugsf6jg4nq5a6qn53qbo6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b37950e9376965942f8dddc16f447d9b93c7c286917c9371b0e83d06f7700bbc

(this sample)

AgentTesla

Executable exe 5f2517598649fe78e58966a15e9fea89e43ee57aa0ad6b779ef18be53eb39a2b

  
Dropping
MD5 32f65b5608137599eb88b876132d1321
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5f2517598649fe78e58966a15e9fea89e43ee57aa0ad6b779ef18be53eb39a2b

Comments