MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4abcd2e038a26f9e78be95d63afc6bb08e1e12d82b1648a9a557c790674f21f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4abcd2e038a26f9e78be95d63afc6bb08e1e12d82b1648a9a557c790674f21f
SHA3-384 hash: 5735a3efa0469a04df0af5f81799b570e5211bdc7465169dcc7ddb7a3315c47f86090c232090944f1d4ac2c989fea8c2
SHA1 hash: 9e7771fb4203adbeb71fdc71bf1c64ac523bc2fa
MD5 hash: e66e0e694928a56731169aab2d7d2f7b
humanhash: skylark-jersey-wisconsin-golf
File name:Catalogue 19702020505.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:334'139 bytes
First seen:2020-05-06 08:34:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:l8Gzb+uaDoo2DcaYW6R8a/qMU/Jkpjp2zyasI6rb7z3XvwU:l8CuokW6RUxJcJa76rD3/1
TLSH FE642370F6D96124706FF33616710F43DC3971719EAEFAA36526F034B866126C998C3A
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: debonairgroupbd.com
Sending IP: 37.49.230.30
From: Sanjivani Khimji Poonja F.F.P.L <sachinpawar@khimjipoonja.com>
Subject: RE: CATALOGUE 2020505n - 10610440
Attachment: Catalogue 19702020505.zip (contains "Catalogue 19702020505.exe")

AgentTesla SMTP exfil server:
smtp.bnb-spa.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.39602.455.25854.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Mbt
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 08:35:48 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2sv42lqdritptz4l5fowhl6gxmeodyjnqkywjcu2kv6hsbtu6ipq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d4abcd2e038a26f9e78be95d63afc6bb08e1e12d82b1648a9a557c790674f21f

(this sample)

AgentTesla

Executable exe 8931fe44a66d78b16c3fc2b5ac8d6fc641b0effe447582742dde10d5469b6956

  
Dropping
MD5 c8599c130254202dc5c58f6309b1242b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8931fe44a66d78b16c3fc2b5ac8d6fc641b0effe447582742dde10d5469b6956

Comments