MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da3c18d14bd5a370a57a631e823fde7483bce4ba59c4d9688ea6d5c728f4b32e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da3c18d14bd5a370a57a631e823fde7483bce4ba59c4d9688ea6d5c728f4b32e
SHA3-384 hash: 563c733281d2a23ce000a073db0b8c31b0cde761afe0fa535ef31b34786c832cffbd972bd2c0e8e5e2a73edccb08fce4
SHA1 hash: 076992b84d221125d785b0819642fef4f79f2eab
MD5 hash: d76917e9a3a62de657532a865dc02e20
humanhash: illinois-quebec-fourteen-lithium
File name:00000000000.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:364'923 bytes
First seen:2020-06-19 16:38:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:COb4izBWxamFvhaYAdhmRfPQMG/NxGetxAtUQ9Vy7RYeYh7jgISnBR4aUH:jb4izoxLwYAdhmBYt//BG67RKxjtSnKH
TLSH 557423161BBEFD0A7D666C330B48251F03A1F6C7081631BC7B62FCF91581A9E28B8476
Reporter abuse_ch
Tags:AgentTesla BRA geo z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: host.etrade.kiev.ua
Sending IP: 185.203.241.24
From: Departamento de contabilidad <fernando.souza@eletrus.com.br>
Reply-To: saleslink@yandex.com
Subject: Confirmar pago
Attachment: 00000000000.z (contains "00000000000.com")

AgentTesla SMTP exfil server:
mail.ereglitso.org.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-19 16:41:27 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3i6brukl2wrxbjl2mmpiep66osb3zzf2lhcns2eou3k4okhuwmxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip da3c18d14bd5a370a57a631e823fde7483bce4ba59c4d9688ea6d5c728f4b32e

(this sample)

AgentTesla

Executable exe 26f9c482fd452faa690d8a0ed01e9962d8850b343af8a59a6817852c6e71f6f6

  
Dropping
MD5 bdec5880ba29dbffb3bd2bc30d681376
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 26f9c482fd452faa690d8a0ed01e9962d8850b343af8a59a6817852c6e71f6f6

Comments