MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4bf71f497dce7a3da9613ac3fec42f39d1b385ba14d0f6152949b16b899143aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4bf71f497dce7a3da9613ac3fec42f39d1b385ba14d0f6152949b16b899143aa
SHA3-384 hash: 2c7be2b58ac5610b013031c494b4e4942567466eb1375ec7ebc465b1bcd7ce13bdcc7bce1f06b7071b1f7268eb881a90
SHA1 hash: 7df4878e9f295c2ca86d31f6c3121eecea31b5ce
MD5 hash: 410f73ad1d89565dc4ead6f4870633bf
humanhash: california-butter-lion-football
File name:Order No 2562020.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'722 bytes
First seen:2020-06-25 09:17:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:yGeCb4rmsTZrxXV+fKxq5k8pj82g8k8Qs6NExnleAPs0TnA:HrWHZb+foOL+BBenleAPhE
TLSH E5942368AC9DD90FE6B4911D4A35AC5ED0BF612A5385722C86FDC3BB83050ECC2784F6
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: nop-germany.com
Sending IP: 199.43.204.173
From: Ainur Reza <info@nop-germany.com>
Reply-To: Ainur Reza <rjjha63@yahoo.com>
Subject: RE: Required Quotation
Attachment: Order No 2562020.zip (contains "Order No 2462020.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.181bf63f744587d9.5579.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23990.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4bf71f497dce7a3da9613ac3fec42f39d1b385ba14d0f6152949b16b899143aa/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jp3r6sl5zz5d3klbhlb75rbphhi3hbn2ctipmfjjjgywxcmriova._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4bf71f497dce7a3da9613ac3fec42f39d1b385ba14d0f6152949b16b899143aa

(this sample)

AgentTesla

Executable exe 870ac09e613a6d594fe92dcfacb22c70e6af1bfa9f0c449b93668e6889a3260b

  
Dropping
MD5 bdd6814edb18bbd6f18041e0b34570d8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 870ac09e613a6d594fe92dcfacb22c70e6af1bfa9f0c449b93668e6889a3260b

Comments