MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 428d98047ab3264b6c653c4500a1422c25829a9237955c2709da7b8ec38519b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 428d98047ab3264b6c653c4500a1422c25829a9237955c2709da7b8ec38519b5
SHA3-384 hash: b36fc726e571c033e5d299a5355a04ea6791925db184791774d9860c56e6aa166e7c8068c3bc100d073359ed41e99cea
SHA1 hash: e909bd8b625b81698ee98efb3e2d5f871578e7c9
MD5 hash: edf2351113d871fb353718aa19cefc70
humanhash: winter-salami-lamp-social
File name:PS-AVP2-202098-20.xls.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:569'445 bytes
First seen:2020-08-30 08:54:41 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:45ulvOKaAfyDSK+PgAY2Taxm8jW/tKdoM5gzu3:4ULaAfyD3URqx2lKdoM5gg
TLSH 6CC423802DBF86657ADB141CE3BDCAF4307F297FC881C6F527A6F6AA335552960C0095
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: host.pstecaudiosource.org
Sending IP: 50.28.51.125
From: Export Department <Rita.Jiang@farletza.com>
Reply-To: Rita.Jiang@farletza.com
Subject: RE: REQUEST FOR QUOTATION - PS-AVP2-202098 / 05884-20
Attachment: PS-AVP2-202098-20.xls.z (contains "PS-AVP2-202098-20.xls.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/428d98047ab3264b6c653c4500a1422c25829a9237955c2709da7b8ec38519b5/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-08-29 10:25:56 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ikgzqbd2wmtew3dfhrcqbikcfqsyfgusg6kvyjyj3j5y5q4fdg2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/428d98047ab3264b6c653c4500a1422c25829a9237955c2709da7b8ec38519b5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 428d98047ab3264b6c653c4500a1422c25829a9237955c2709da7b8ec38519b5

(this sample)

AgentTesla

Executable exe fe6515e661c3c83f45ab0727c45909344f41d8ad37123bcc35af0232378d60b8

  
Dropping
MD5 b7134c001fcf541f93ee8b0a5fadd337
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fe6515e661c3c83f45ab0727c45909344f41d8ad37123bcc35af0232378d60b8

Comments