MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e17c43656bb2adc94e662d44f81ed72e9b563bc50876fa1da4dce47b1a8e7634. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e17c43656bb2adc94e662d44f81ed72e9b563bc50876fa1da4dce47b1a8e7634
SHA3-384 hash: 5311102bf9dfa02122034dd2db57a3212decd0070cb8015da0d9bceaa06beee484262869c2a960d82e4189e15cda227b
SHA1 hash: 5057dbf3e75275def37f4cb20beca00a777d61db
MD5 hash: 4537a80c325b5a0023d0f4aae1cf6f1a
humanhash: apart-hot-oxygen-delaware
File name:Proforma invoice 04.08.2020.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:611'980 bytes
First seen:2020-08-04 06:57:13 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:RqyEBvPRWIIT01gJxlOabQoUTK905miT4aUwySAEOiH7uFjR2MMrGI:RqyQp5IA1gJbvblUTK905miTPIElHaJg
TLSH 15D42332FB98411305C15327B865E1CB0806F9D99B400E5AFB9BE9B3F5F9CA15247B2B
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: fosetico.com
Sending IP: 109.228.8.101
From: Peter Leong <peterleong8@gmail.com>
Subject: Proforma invoice 04.08.2020
Attachment: Proforma invoice 04.08.2020.7z (contains "Proforma invoice 04.08.2020.exe")

AgentTesla FTP exfil server:
ftp.fratellidelpiano.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e17c43656bb2adc94e662d44f81ed72e9b563bc50876fa1da4dce47b1a8e7634/
Threat name:
ByteCode-MSIL.Trojan.AgnetTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 06:59:05 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4f6egzllwkw4sttgfvcpqhwxf2nvmo6fbb3puhne3tshwguooy2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e17c43656bb2adc94e662d44f81ed72e9b563bc50876fa1da4dce47b1a8e7634

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z e17c43656bb2adc94e662d44f81ed72e9b563bc50876fa1da4dce47b1a8e7634

(this sample)

AgentTesla

Executable exe e86142f3f4772825135e389edefa8b13db71930958ea6611a6287bf644cc5414

  
Dropping
MD5 3962e9b89b828c1937a0bd69113e671f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e86142f3f4772825135e389edefa8b13db71930958ea6611a6287bf644cc5414

Comments