MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2337ed8959dcbdd8cd3b0e75be9f3f5853992e458b898aaf3d269202dc86eda3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2337ed8959dcbdd8cd3b0e75be9f3f5853992e458b898aaf3d269202dc86eda3
SHA3-384 hash: c288094ce59b36e1ef7b5a0f3f323131e025d875567f2d9f95270606941b5e22f1a782d1eb8365866fd7af2b6dd5a128
SHA1 hash: 26308252b1488ae55dde3d3b131bfcda68a7231b
MD5 hash: 53ff93075f0255ae7a8797e2734b17ba
humanhash: mockingbird-snake-massachusetts-november
File name:Po-331983- Pdf.lzh
Download: download sample
Signature AgentTesla
Create hunting rule
File size:620'264 bytes
First seen:2020-08-28 06:03:14 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:+860ts4PfzXAvuJPQtfNbedUpHYUG2TdzzHBbP:akrAmJPOId83FP
TLSH D3D4234B787824AE871A547E63DF25A8381F6AA889E057CC301D19F336B73D2C9750ED
Reporter abuse_ch
Tags:AgentTesla lzh Outlook


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: EUR06-AM7-obe.outbound.protection.outlook.com
Sending IP: 40.92.16.64
From: Gogo Kondyli <gkondyli@hotmail.com>
Subject: Aw; Request for quotation
Attachment: Po-331983- Pdf.lzh (contains "LmmDm1gMY4XV2Ti.exe")

AgentTesla SMTP exfil server:
roham.dnswebhost.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2337ed8959dcbdd8cd3b0e75be9f3f5853992e458b898aaf3d269202dc86eda3/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 06:05:05 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=em363ckz3s65rtj3bz235hz7lbjzslsfroeyvlz5e2jafxeg5wrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2337ed8959dcbdd8cd3b0e75be9f3f5853992e458b898aaf3d269202dc86eda3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 2337ed8959dcbdd8cd3b0e75be9f3f5853992e458b898aaf3d269202dc86eda3

(this sample)

AgentTesla

Executable exe d5683e9201b5e1962693f4fd6d5485a553ed8537c6956c6bfed7d040d20069f0

  
Dropping
MD5 7483acf66e65e0870c1180f64e985bab
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d5683e9201b5e1962693f4fd6d5485a553ed8537c6956c6bfed7d040d20069f0

Comments