MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4c7f8962e9f9b8b7a1a8b40564d013c2c8b7094c3976642eb5b1aaac0e3c0ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4c7f8962e9f9b8b7a1a8b40564d013c2c8b7094c3976642eb5b1aaac0e3c0ac
SHA3-384 hash: 0366e0a3c1dde1923a441bfc772255ce893abd0de437641fd47ddb24fed612f2d0dc24317ecfc9006eba36020780ec82
SHA1 hash: f9ef502f57113971f12537b91ed5c84ec7ee16dc
MD5 hash: bd465f11c45a926cd30d89b8a48734cb
humanhash: vermont-mississippi-diet-freddie
File name:próbka produktu.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'305 bytes
First seen:2020-06-25 09:06:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:nFn8TdIOPJXBlmlcPL8qA3dHi4oGwkuQB3GugpDvxsYAfjEZyNXDCKG812RRq:FS3BMqAlix3rGWxs/EsCa12RQ
TLSH 239423361838F174E14C9E582A9B9F63716CEF754B64DA14B133E2262EB3E3A1E0541B
Reporter abuse_ch
Tags:AgentTesla geo POL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: host2.himbimarket.com
Sending IP: 72.52.244.66
From: Gökmen Akbulut <gokmen@manfredgeldbach.com.tr>
Subject: Fwd: Re: Re: oferta nowego zamówienia
Attachment: próbka produktu.zip (contains "próbka produktu.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.44022.26029.17820.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e4c7f8962e9f9b8b7a1a8b40564d013c2c8b7094c3976642eb5b1aaac0e3c0ac/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4td7rfrot6nyw6q2rnafmtibhqwiw4euyolwmqxllmnkvqhdycwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e4c7f8962e9f9b8b7a1a8b40564d013c2c8b7094c3976642eb5b1aaac0e3c0ac

(this sample)

AgentTesla

Executable exe 290b7b9ba299da27932bef418349be7ec922ecce2c1e0840d4f2630cfc4f2f78

  
Dropping
MD5 81a92e48a094a9d2ebb006fb24f6ba08
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 290b7b9ba299da27932bef418349be7ec922ecce2c1e0840d4f2630cfc4f2f78

Comments