MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5c3ca6c6caccc8a2c02d6eb847140704558d1953c64a2fc431fc36b8482d343. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5c3ca6c6caccc8a2c02d6eb847140704558d1953c64a2fc431fc36b8482d343
SHA3-384 hash: 99874aa52e986ef149d8c7b77ef389c53dbb0692d27d1a3a2eb0063a1e48e5108b779b631e49297440da7b6a23b2cf72
SHA1 hash: 24ff04311dd68e40436587ed2133de4493e6bd61
MD5 hash: b4af9e64db381fb8c259870853855995
humanhash: green-summer-hotel-illinois
File name:Yhl202000233_oo3.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'033'770 bytes
First seen:2020-08-18 12:09:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:SzR9yWpCkNTsKZN71C1r3NEx2dAu6y61NYcoGTP:SzR9ckNnn71Cp3NEgJT6zYcx
TLSH BE2533C545E66B3127A55FD3B2B6C3099D838C85B2D6853110BB31970B5B8A3BF339A3
Reporter abuse_ch
Tags:AgentTesla MailChannels zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bisque.elm.relay.mailchannels.net
Sending IP: 23.83.212.18
From: chan-ming@sublimitemail.xyz
Subject: RE: FOB kaohsuing to Riyadh (Alsamasy) 3x40HQ S/元山工業
Attachment: Yhl202000233_oo3.zip (contains "Yhl202000233_oo3....................................................................................................................exe")

AgentTesla SMTP exfil server:
mail.puntomesa.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5c3ca6c6caccc8a2c02d6eb847140704558d1953c64a2fc431fc36b8482d343/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-18 12:11:03 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wxb4u3dmvtgiulac23vyi4kaobcvrumvhrskf7cdd7bwxbec2nbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/b5c3ca6c6caccc8a2c02d6eb847140704558d1953c64a2fc431fc36b8482d343

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b5c3ca6c6caccc8a2c02d6eb847140704558d1953c64a2fc431fc36b8482d343

(this sample)

AgentTesla

Executable exe 416f9746f079b7af4180264d06ce55b88b1547d9a9da8db352e06a13aa5cf4a1

  
Dropping
MD5 8faf5d10b248e41031051c90b34ffbf9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 416f9746f079b7af4180264d06ce55b88b1547d9a9da8db352e06a13aa5cf4a1

Comments