MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4adf3a463ba80e109229111d354ceeb9497d73f4aa8a10afee43f785e60d4531. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4adf3a463ba80e109229111d354ceeb9497d73f4aa8a10afee43f785e60d4531
SHA3-384 hash: 939c6f77dbe2abcbfd758df8f043533fe38d0375892dde62978d8ef0028913d6d611bc9185d3a2f76faabc2da48258fb
SHA1 hash: 22a577412a44f891217f193e6566eb1d4870dabe
MD5 hash: 7f81bb9fba5c2446a15bbc3e15dcf3f2
humanhash: indigo-network-connecticut-equal
File name:BISSELL INT - PO200513DCC025R-001.doc.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:444'849 bytes
First seen:2020-08-05 17:11:55 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:OTI9rKLlXeH//8Ns5Zg/3Fu8qcqjinFKsEVc/:K3lXgsC/gPFDRkVW
TLSH F994230EA7FC8711898CB360A479098BC462B793755259F6E0F6787624DDFA00E6DC78
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: [37.49.229.235]
Sending IP: 37.49.229.235
From: Angeles Ureta <angeles.ureta@airesgifts.cl>
Subject: BISSELL INTERNATIONAL - PO#200513DCC025R-1
Attachment: BISSELL INT - PO200513DCC025R-001.doc.z (contains "BISSELL INT - PO#200513DCC025R-001.doc.exe")

AgentTesla SMTP exfil server:
mail.daiphatfood.com.vn:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27215.RarHeur.nocdb.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4adf3a463ba80e109229111d354ceeb9497d73f4aa8a10afee43f785e60d4531/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 17:13:10 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jlpturr3vahbberjceotkthoxfex247uvkfbbl7oip3ylzqniuyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4adf3a463ba80e109229111d354ceeb9497d73f4aa8a10afee43f785e60d4531

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 4adf3a463ba80e109229111d354ceeb9497d73f4aa8a10afee43f785e60d4531

(this sample)

AgentTesla

Executable exe 85381937986fd4a23e7d01e56f02a097dc2cfa7967f1aeb2f2d8708206951e34

  
Dropping
MD5 3d289caab39914d2d78da57dcd537c89
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85381937986fd4a23e7d01e56f02a097dc2cfa7967f1aeb2f2d8708206951e34

Comments