MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2350f81d128d505ff4c09a24dcfed81151985087ad4d27d9c3a898ae71c8dd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2350f81d128d505ff4c09a24dcfed81151985087ad4d27d9c3a898ae71c8dd5
SHA3-384 hash: 2fef82b9a6e94a7df4add9a03bc6a0122778648abf7924cf228020f0f0cb23169651ce92255759c7a9f650ac7fda6e18
SHA1 hash: 673f21e3c05cc3cf77275790f3ba83902e0d4b3f
MD5 hash: e1a7306d80707989d7fb50b4bfb1a58c
humanhash: hydrogen-winner-magnesium-apart
File name:Contract INV.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:467'234 bytes
First seen:2020-08-30 08:54:08 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:PQrnPiIFWf+2NkomicaXo98xzbcicTGrfgfkaKyqMRgmkicxkcXnFkAe5gGaEGX7:orSkzzKo90zViGrfgH5ki4Xna/a3X7
TLSH 99A4238844679C137D9E78A085C8ECB4841D8AB6544BEF6A61F7FD7638AA7C8CC074F1
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: centreforaviation.com
Sending IP: 37.49.230.200
From: Lucy Anderson <info@centreforaviation.com>
Subject: Signed Contract Invoice
Attachment: Contract INV.Z (contains "Contract INV.exe")

AgentTesla SMTP exfil server:
mail.transfastc.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2350f81d128d505ff4c09a24dcfed81151985087ad4d27d9c3a898ae71c8dd5/
Threat name:
ByteCode-MSIL.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2020-08-29 10:41:07 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6i2q7aorfdkql72mbgre3t7nqekrtbiiplkne7m4hkeyvzy4rxkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f2350f81d128d505ff4c09a24dcfed81151985087ad4d27d9c3a898ae71c8dd5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z f2350f81d128d505ff4c09a24dcfed81151985087ad4d27d9c3a898ae71c8dd5

(this sample)

AgentTesla

Executable exe 95288eb9eb753179b5e44337933fa86d6d60889fe7189b445c73b8cc77f05240

  
Dropping
MD5 a5a33692171dfcaea7c829656937f4ee
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 95288eb9eb753179b5e44337933fa86d6d60889fe7189b445c73b8cc77f05240

Comments