MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46f52fd4e9bcb3966c41e47bcb7bc1ff0cebd9fb72ceafd3b6b9380470c3ba4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46f52fd4e9bcb3966c41e47bcb7bc1ff0cebd9fb72ceafd3b6b9380470c3ba4c
SHA3-384 hash: 1571f8fa5d74838cffcaece7419c89ca0b0b1278ee48734350e6d1be2f1b27a4e7f38cbbb1262af9752e4b022078e703
SHA1 hash: f1177cc04aa8d3a45902eb22de9be44c3a9584a0
MD5 hash: 1edc7704f91ea6f6b87f52944ee72b8d
humanhash: east-eighteen-angel-lamp
File name:SCAN_PO CTL209-026.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:285'141 bytes
First seen:2020-07-08 06:14:31 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:8FR6/JpCKfDrh6+GC98+A6UNHwRHeikej/uzPizszP+7+VXq4V:UR6pCKrt6+GC98+AVUeiklz/P+qw4V
TLSH 8554239D5DB1EC1E2D1FDC462184C8E71BDAE5C80F91CE04A8639BE8439720DB9978DE
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.pannaco.cf
Sending IP: 64.225.119.253
From: Jeffer Cheng <info@pannaco.cf>
Subject: Quotation number PO CTL209-026 additional list for Week 21
Attachment: SCAN_PO CTL209-026.gz (contains "SCAN_PO CTL209-026.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.3091.26077.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46f52fd4e9bcb3966c41e47bcb7bc1ff0cebd9fb72ceafd3b6b9380470c3ba4c/
Threat name:
Win32.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 06:16:08 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i32s7vhjxszzm3cb4r54w66b74goxwp3olhk7u5wxe4ai4gdxjga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 46f52fd4e9bcb3966c41e47bcb7bc1ff0cebd9fb72ceafd3b6b9380470c3ba4c

(this sample)

AgentTesla

Executable exe 584a478de02fc860c167744004fc7db00f5e298d181d2bf3779d622f97e52293

  
Dropping
MD5 359f0f7c466bec1b47dc18426c2fb489
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 584a478de02fc860c167744004fc7db00f5e298d181d2bf3779d622f97e52293

Comments