MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35b586adfd3a1223e6e6bf5301a63e66fff0b283170a1dc28432d55ccae36ec7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35b586adfd3a1223e6e6bf5301a63e66fff0b283170a1dc28432d55ccae36ec7
SHA3-384 hash: 26c2302abc8b5a52a020265aafc919cb8d0ef03055029a74b91527d32b7a4c5cf623da65849272276f6d3007b67302db
SHA1 hash: b9160c597548717464359ec03d87acc63124e3dd
MD5 hash: 5dcd4ed389e9af0b10aafbe853574fbb
humanhash: high-beer-yankee-salami
File name:SOA_payment_balance.doc.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:514'369 bytes
First seen:2020-11-26 07:07:42 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:/pi2FSmLi0ir/zsw3DZp6fxR1tNDV7/P7VvZ:Q2FSmW/r/zs8DjMxLvDV7n7VvZ
TLSH EAB42359B0EEAC8DC82C4BD5AD829C41D6989DC15DE1A93040A27DBFC7B472634B1FCB
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?ICIg5LuY5Li95Li5WmhhbmQgUGVuZyI=?= <sales.coate@greenroad.com.cn>" (likely spoofed)
Received: "from greenroad.com.cn (unknown [185.222.58.102]) "
Date: "25 Nov 2020 19:03:47 -0800"
Subject: "Re: SOA of payment and balance---"
Attachment: "SOA_payment_balance.doc.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35b586adfd3a1223e6e6bf5301a63e66fff0b283170a1dc28432d55ccae36ec7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-26 04:00:15 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gw2ynlp5hijchzxgx5jqdjr6m377bmudc4fb3queglkvzsxdn3dq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 35b586adfd3a1223e6e6bf5301a63e66fff0b283170a1dc28432d55ccae36ec7

(this sample)

AgentTesla

Executable exe 4415d19e0b69bdccf79c937db6fe491c4875367cc3ad808b233fa606c708c18b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4415d19e0b69bdccf79c937db6fe491c4875367cc3ad808b233fa606c708c18b
  
Dropping
AgentTesla

Comments