MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8f0ae3b15e6af046e9ef94a6c9f7839ebc1f37348291aebdcf98715bf331471. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8f0ae3b15e6af046e9ef94a6c9f7839ebc1f37348291aebdcf98715bf331471
SHA3-384 hash: a3c01bb912d4c76bc1ab5e4e061367f675686ec1e395aeb14608f4506fdaf63395c0aa9abadabd2ae8c0990411a9392c
SHA1 hash: fb3c7296edf7f0394dc37f818fac9b104e32dd6f
MD5 hash: 773a55dbed0283c2a1cf99b85ecfd3cc
humanhash: uncle-washington-edward-hot
File name:PI2010081650.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:412'756 bytes
First seen:2020-07-07 10:02:15 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:Lg6j6Pxfn1o0T3txVd6meT/EelwSfhLtA:E6jctxHWEeBZq
TLSH B7942336C9A0071EE3538F7D1209C43EF9BC507225532B51E67257B99899533FEE888B
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server0.metosan.cc
Sending IP: 104.168.213.72
From: Linda.xiu <info@metosan.cc>
Subject: Fw: RE: Outstanding PI201008165
Attachment: PI2010081650.z (contains "PI2010081650.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8f0ae3b15e6af046e9ef94a6c9f7839ebc1f37348291aebdcf98715bf331471/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 10:04:05 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3dyk4oyv42xqi3u67ffgzh3yhhv4d43tjaurv2647gdrlpztcryq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z d8f0ae3b15e6af046e9ef94a6c9f7839ebc1f37348291aebdcf98715bf331471

(this sample)

AgentTesla

Executable exe d96fb3fa5c309d3ec542c767d220336399ba763a0509b75fd08fc5fbffc7b2ff

  
Dropping
MD5 e4d311dd1b0e3fc5275285ae183677d5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d96fb3fa5c309d3ec542c767d220336399ba763a0509b75fd08fc5fbffc7b2ff

Comments