MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4725bf877d85a2fea6562157e39239e1c57f0cb6167579e9f5ddd405b364f484. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4725bf877d85a2fea6562157e39239e1c57f0cb6167579e9f5ddd405b364f484
SHA3-384 hash: e8cdc4a46faee9a3cef6efdbdc91cb1f1beaeb536989ad7a7b0b92d8546d27d8b0e4fe421f0f9e7245ac58993e4b81f4
SHA1 hash: 806d6970e9a02a758e7683e8bedddec68ec27ed8
MD5 hash: 0e1bf7ec6a39e3205c0aad2286325ef1
humanhash: zebra-dakota-whiskey-hot
File name:pricelists and offer.uue
Download: download sample
Signature AgentTesla
Create hunting rule
File size:437'971 bytes
First seen:2020-06-10 07:02:31 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 12288:UJpPgGkV7eiaovJWgrbaxbwbDu3jibnUc:eg11faovn3iwb63O9
TLSH 5A9423354E4234DA72E50AA17EDFA2700225F5D4FF287C163B8B657C2DFAB849ACD106
Reporter abuse_ch
Tags:AgentTesla uue Yahoo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic311-25.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.188.206
From: Maria Bianchi <modesterclave@yahoo.com>
Reply-To: Maria Bianchi <modesterclave@yahoo.com>
Subject: Fw: RFQ FOR QUOTATION [UPDATED PRICELIST]
Attachment: pricelists and offer.uue (contains "pricelists and offer.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 07:04:04 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i4s37b35qwrp5jswefl6herz4hcx6dfwcz2xt2pv3xkalm3e6sca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

uue 4725bf877d85a2fea6562157e39239e1c57f0cb6167579e9f5ddd405b364f484

(this sample)

AgentTesla

Executable exe 1cfd5099c6a8bf03aea60b09f4e7b829eadfcc1c0cc55f2c8bfbae01c03e56e2

  
Dropping
MD5 8d79253bee8a8bbaf45bef3e701457e2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1cfd5099c6a8bf03aea60b09f4e7b829eadfcc1c0cc55f2c8bfbae01c03e56e2

Comments