MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c97ad1ebb10ce3473f9a9e8aa22ee881771225c9decbdcc011930b073ee2a9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c97ad1ebb10ce3473f9a9e8aa22ee881771225c9decbdcc011930b073ee2a9c
SHA3-384 hash: b0e90e1c0847cd977e828cc2a0d188c043eeddc7e44aa6b9690d524e9d8d59ef51928a2182780fddc9375639aaa7d3cf
SHA1 hash: ba9bda181a388eb8b7e125c1bc1386b42ecba068
MD5 hash: b30c5376e596e59df10ea02e0c101ffa
humanhash: happy-charlie-blue-princess
File name:WT0045679.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'243 bytes
First seen:2020-07-10 07:05:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:aGtmwnO/CCOzc8lk2Xe05HuiLrVducrhAssuZMzbiaxFy/NjZ71p+drZKtkhoC4B:aGtmwGI805HDbbhAztfiaxQz4Mtk+qQ
TLSH 4D8423B829C01DB49F4375819279C7B283A14DA59186FB4107AB9CF07F93E84BAF259C
Reporter abuse_ch
Tags:AgentTesla Endurance rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 142-4-22-49.unifiedlayer.com
Sending IP: 142.4.22.49
From: Aleong, Rebecca <pgne.documentation@oiaglobal.com>
Subject: Incoming Payment advice-BG_EDG7602020062601480045_423_760
Attachment: WT0045679.rar (contains "WT0045679.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c97ad1ebb10ce3473f9a9e8aa22ee881771225c9decbdcc011930b073ee2a9c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 07:07:04 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fsl22hv3cdhdi47zvhukuixoralxcis4txwl3tabdeyla47ofkoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 2c97ad1ebb10ce3473f9a9e8aa22ee881771225c9decbdcc011930b073ee2a9c

(this sample)

AgentTesla

Executable exe de638d68163fe7f49b3371adbe9456b2c2ed2ef5182324e768dc42793591c7de

  
Dropping
MD5 8b721799c0f207360c4077fe7a3a1c24
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 de638d68163fe7f49b3371adbe9456b2c2ed2ef5182324e768dc42793591c7de

Comments