MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e67d17b45e9161593f1ebda9934fcc7dcc73835a17aa98333f11a9c9ab38e66d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e67d17b45e9161593f1ebda9934fcc7dcc73835a17aa98333f11a9c9ab38e66d
SHA3-384 hash: a8e32a287d71cb4ae780c599a3e1af2e8c18cd3db48612c3afaa335bfa32542d1b6bc5a8094787d1e8925982d284f4c1
SHA1 hash: 04ffc9b75356c57372eeb6ff4d465508cb850f5a
MD5 hash: e45836b165a19688a991f3061e15f11f
humanhash: south-hamper-kentucky-green
File name:MV.EVER - AGENCY APPOINTMENT.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'577 bytes
First seen:2020-06-11 05:55:18 UTC
Last seen:2020-06-11 06:21:33 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:ISmeEPwb3KTKO3/RrhCJoQPhI09YTe50s1fr2TYpBDgDds7Zluo90KbTTr6/Mu/:BmexzrOvRrhJQJI0ue50s4yECjupETo/
TLSH EC94234F799B2519F40158D2FEA8D40DC0F335AC0FFA615CD08ADA8C9526E93BF641E2
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pluto.mintyhippo.xyz
Sending IP: 45.79.27.84
From: wangjunduo <wangjunduow@chunan.com.cn>
Subject: MV.EVER PROGRESS 232//LIANYUNGANG//AGENCY APPOINTMENT
Attachment: MV.EVER - AGENCY APPOINTMENT.rar (contains "MV.EVER - AGENCY APPOINTMENT.exe")

AgentTesla SMTP exfil server:
smtp.desmaindian.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.NN.ZemsilF.34128.Km0@aaKpKnh.12298.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 05:57:06 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4z6rpnc6sfqvspy6xwuzgt6mpxghha22c6vjqmz7cgu4tkzy4zwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e67d17b45e9161593f1ebda9934fcc7dcc73835a17aa98333f11a9c9ab38e66d

(this sample)

AgentTesla

Executable exe af10fd061b63527e2a6353e95e7548b287af7bf5f78335dcfb5e6de2cf43a1b5

  
Dropping
MD5 54e6f195bb68fb7e67993d366cd9aa98
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 af10fd061b63527e2a6353e95e7548b287af7bf5f78335dcfb5e6de2cf43a1b5

Comments