MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3546212c1dd76d4af5ac51e905d260b96494fb31fbec2a32e1fb6b2b8acf46f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3546212c1dd76d4af5ac51e905d260b96494fb31fbec2a32e1fb6b2b8acf46f4
SHA3-384 hash: 5a99e3c0e965be95f4d03303f125176cb92b53032b72965eb1b92cbd2f62a3976e2909bd00a313358423a41918fcddb9
SHA1 hash: 51c1083a30c0c8e62aef1ebe94cb81417ec444b8
MD5 hash: c6e2eddc60470670a3792a3e83873692
humanhash: moon-violet-double-pasta
File name:PO 459ARG1672020.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:289'565 bytes
First seen:2020-07-16 08:04:12 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 6144:9gGvAAq45J9Bb8z3BVAMQuC+KozFIH2uRMRKSRk7p7sFLm0DlLv5mWrd:qzRAJ7b8TgMQuCQJESO06a7lrd
TLSH 8C54234BB580307953E97EB55FAC510AFDC6FC7E1A33A0E620022DDFA69386116ED706
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: srv2.trendstudio.it
Sending IP: 62.116.182.204
From: Elena <info@excellaglobal.com>
Subject: PO#459ARG16072020-URGENTE
Attachment: PO 459ARG1672020.xz (contains "PO# 459ARG1672020.scr")

AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3546212c1dd76d4af5ac51e905d260b96494fb31fbec2a32e1fb6b2b8acf46f4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 08:06:06 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gvdccla525wuv5nmkhuqlutaxfsjj6zr7pwcumxb7nvsxcwpi32a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz 3546212c1dd76d4af5ac51e905d260b96494fb31fbec2a32e1fb6b2b8acf46f4

(this sample)

AgentTesla

Executable exe 6da9729b89ad6b0aff3f94e20754a9d46185fe0c9076aa950ddf8e4e720e5ef0

  
Dropping
MD5 64e367c58afd3f0b145184e91dbbc808
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6da9729b89ad6b0aff3f94e20754a9d46185fe0c9076aa950ddf8e4e720e5ef0

Comments