MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 386f014f4506ae3200f79ec16c1942832e102e38efb9f850b185952056733143. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 386f014f4506ae3200f79ec16c1942832e102e38efb9f850b185952056733143
SHA3-384 hash: efab5c30e314cac8c660f47a5b1e0a8bff478312e6110a4c228b08c168b12b3ff6976bd60cc84777cc495a84baa80762
SHA1 hash: f0e81e34b7317c2a74b19ef4023830124b9341cb
MD5 hash: 5c34667af449f7aec0ac9a29b0bc3ebf
humanhash: single-burger-summer-summer
File name:Attached Po.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:680'166 bytes
First seen:2020-08-18 13:38:17 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:plJ3PUM4PBWjHTG513f/OY1oTEVO1MzXofqMSeKk4zFRsU+U:TJ3PUMXMuY1oT28qMg7zkjU
TLSH 65E4230B281E15B67EEFAEE061AB7062854D0BC4F99411B01700B6D6E7A523B3FD1DBC
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.manisanet.net
Sending IP: 89.252.178.16
From: Riley Baker <rileybaker@gmail.com>
Subject: Purchase Order
Attachment: Attached Po.gz (contains "Attached Po.exe")

AgentTesla SMTP exfil server:
ftp.becommodal.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/386f014f4506ae3200f79ec16c1942832e102e38efb9f850b185952056733143/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:40:07 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hbxqct2fa2xdeahxt3awygkcqmxbalry5647qufrqwksavttgfbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/386f014f4506ae3200f79ec16c1942832e102e38efb9f850b185952056733143

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 386f014f4506ae3200f79ec16c1942832e102e38efb9f850b185952056733143

(this sample)

AgentTesla

Executable exe f242ad8f253e4e481529cffa7b3d697683649ba31b8c8500f2d24d2bf591e553

  
Dropping
MD5 69e73370e800958686a887787390acc5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f242ad8f253e4e481529cffa7b3d697683649ba31b8c8500f2d24d2bf591e553

Comments