MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4897288d70d0c678cb1f9c4a5fa0edb5bc91a9e44aeea4c0bee35e868a3341d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4897288d70d0c678cb1f9c4a5fa0edb5bc91a9e44aeea4c0bee35e868a3341d2
SHA3-384 hash: 82ec8679a63e5dddca30853888203a9b920fa3cd7b16d4e1bf493f430bf6028188b952eb5962f7ba3fb206f9aa386c92
SHA1 hash: cdb8bba4ce6c58c597565f0a807ba21e183c9cf3
MD5 hash: 1446311cd1ad560f63e5ed08f5e238cd
humanhash: indigo-orange-nuts-pip
File name:JULY RFQ.Gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:338'858 bytes
First seen:2020-07-02 12:24:46 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:Wo1gCM6vEQu5uyLFvYFIBT1T+DnTZr4/pau4MbKp8ZmM1zTqpjSuVyedAr6QU:V1c4EHrNBRkTZr4xBfZmCu0AAr6J
TLSH F37423E5D53008EA61C33591BFACEE19071567A9B0899328CCA3DCE97AFF0418B6D487
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: eastseatravel.com
Sending IP: 185.236.203.214
From: Benard Alvarez <pnh@eastseatravel.com>
Subject: Request for quotation july 2020
Attachment: JULY RFQ.Gz (contains "md3ULNa79RqZgtc.exe")

AgentTesla SMTP exfil server:
smtp.lettu.us:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4897288d70d0c678cb1f9c4a5fa0edb5bc91a9e44aeea4c0bee35e868a3341d2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 12:26:08 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jclsrdlq2ddhrsy7trff7ihnww6jdkpejlxkjqf64npincrtihja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 4897288d70d0c678cb1f9c4a5fa0edb5bc91a9e44aeea4c0bee35e868a3341d2

(this sample)

AgentTesla

Executable exe d4e3bae2154ae1c4e7609f284310bb16ce70fdc9875e15928ed1b0f6f44438e2

  
Dropping
MD5 6eac3cd9b14c3cd09db4e6fa42d90345
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d4e3bae2154ae1c4e7609f284310bb16ce70fdc9875e15928ed1b0f6f44438e2

Comments