MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46d33f2e224e9fe0072a3ac154551c68d58fa72979920b596e0015bebb64c8a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46d33f2e224e9fe0072a3ac154551c68d58fa72979920b596e0015bebb64c8a3
SHA3-384 hash: 7c42c16edd5abd708437b8a7dcc28733065e0549d90ee5d4300f7b9ede01008a0337fe848058bc4e409e9af92591fa38
SHA1 hash: 89bcee400b3eb00867ea5dbd2acd6980925d1c2e
MD5 hash: a4afb4cdd0de22bb544e4ec3ff44dca2
humanhash: nebraska-oklahoma-july-kilo
File name:Payment Notification.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:416'446 bytes
First seen:2020-06-25 09:09:57 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:qeSVAQRxdW5NVf+wVRvXPLGhVbPRSJ204r:qeyxx8VGKRv/qDEJ204r
TLSH 8694331DE8DBD4EB928C1A16639C05FD8361BCC84CCE609CB2C47BDA09796296D90DF7
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: copyd.duckdns.org
Sending IP: 161.35.11.40
From: paymentemail@fnb.co.za
Subject: Payment Notifcation
Attachment: Payment Notification.z (contains "Payment Notification.exe")

AgentTesla SMTP exfil server:
zstcznz.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46d33f2e224e9fe0072a3ac154551c68d58fa72979920b596e0015bebb64c8a3/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i3jt6lrcj2p6abzkhlavivi4ndky7jzjpgjawwloaak35o3ezcrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 46d33f2e224e9fe0072a3ac154551c68d58fa72979920b596e0015bebb64c8a3

(this sample)

AgentTesla

Executable exe 0b9154673724c07904e3defc44ffb63a68cc35ae660d5eb3992fe816e0e2af1f

  
Dropping
MD5 ca3ddd5989cbd549d31d0d767c105b37
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0b9154673724c07904e3defc44ffb63a68cc35ae660d5eb3992fe816e0e2af1f

Comments