MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 369da6c535b8119d4b66593951b4b7939550e4454f9514869c408487a73634cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 3 Yara 3 Comments

SHA256 hash: 369da6c535b8119d4b66593951b4b7939550e4454f9514869c408487a73634cd
SHA3-384 hash: ba607219d480f3534bc7b75f5cfe48afc96dca4c1038e6b63906c6c81ccadd983f18f03c91bb00a026db4e6faf6fe55e
SHA1 hash: 4a360f0e3e437af3e951bcd77b99b8de1bdc9a34
MD5 hash: 2d8c1706c2ecb3d0abd19e7434cdbf10
humanhash: sixteen-mirror-connecticut-quiet
File name:60217778xls.scr
Download: download sample
Signature AgentTesla
File size:525'312 bytes
First seen:2020-06-30 12:04:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 12288:K42IY2YPL64c8dobYUWrOrvQ53cMQvkYsw:K42IxkL6nQobYrKrF
TLSH 60B4BEB0B2585ED5DC623EF58573A8E13F62BDAB1425C7281D2F76A10A33382D163E17
Reporter @abuse_ch
Tags:AgentTesla scr Yahoo


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: sonic315-15.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.134.125
From: ALOROBA.Cont.Co. L.L.C <d_rojas.borgatta@yahoo.com>
Reply-To: ALOROBA.Cont.Co. L.L.C <hunt-greg@hotmail.com>
Subject: INV&SWIFT E20/001828 GWENT
Attachment: 60217778xls.xz (contains "60217778xls.scr")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 26
Origin country FR FR
CAPE Sandbox Detection:AgentTeslaV2
Link: https://www.capesandbox.com/analysis/17099/
ClamAV SecuriteInfo.com.Generic-EXE.UNOFFICIAL
CERT.PL MWDB Detection:agenttesla
Link: https://mwdb.cert.pl/sample/369da6c535b8119d4b66593951b4b7939550e4454f9514869c408487a73634cd/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Androm
First seen:2020-06-30 12:06:05 UTC
AV detection:20 of 30 (66.67%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:agenttesla
Link: https://tria.ge/reports/200630-wx7yzm49la/
Tags:spyware keylogger trojan stealer family:agenttesla
VirusTotal:Virustotal results 12.33%

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

31837bf2197db78d7e3a398cc6e36e01

AgentTesla

Executable exe 369da6c535b8119d4b66593951b4b7939550e4454f9514869c408487a73634cd

(this sample)

  
Dropped by
MD5 31837bf2197db78d7e3a398cc6e36e01
  
Delivery method
Distributed via e-mail attachment

Comments