MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d63a49a86e6d9925722936e9c7a16b73b4899c0341d229060e5cd3486a45550. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 4d63a49a86e6d9925722936e9c7a16b73b4899c0341d229060e5cd3486a45550
SHA3-384 hash: 0a003d93c829b7adaee73c417c28a4a53d06fa3c40f08f76d87f409fa12d59766a366cbc8a3ecd78f9db1e17786129f7
SHA1 hash: 91432aa75992b99055c449d339dd9c4c186c74eb
MD5 hash: 9be6fa6e9d0cd6e8eee3c3642cdc7ffa
humanhash: eight-south-pluto-hawaii
File name:sev 706.zip
Download: download sample
Signature AgentTesla
File size:963'261 bytes
First seen:2020-06-18 06:03:00 UTC
Last seen:2020-06-18 13:41:15 UTC
File type: zip
MIME type:application/zip
ssdeep 24576:E+hW4MXovfCy0uyglYAJ/3jEi2l9xmOPs59:EejLg5glF3e9sOE59
TLSH 2B2523558A723DA3A1B83E9A217C4E292F73D322323F188FE77569F43C61456B211357
Reporter @abuse_ch
Tags:AgentTesla zip


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: nationalmarine.com
Sending IP: 103.99.2.4
From: Will Mosher <will@nationalmarine.com>
Subject: (No Subject)
Attachment: sev 706.zip (contains "sev 706.exe")

AgentTesla SMTP exfil server:
smtp.sarniotex.com:587

Intelligence


File Origin
# of uploads :
2
# of downloads :
31
Origin country :
US US
Mail intelligence
Geo location:
Global
Volume:
High
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Status:
Malicious
First seen:
2020-06-18 06:04:14 UTC
AV detection:
22 of 31 (70.97%)
Threat level
  5/5

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4d63a49a86e6d9925722936e9c7a16b73b4899c0341d229060e5cd3486a45550

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments