MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58911dc3272cba4185fc262e7801dbbef17a2fd6c6e361be31305255ba4e11a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58911dc3272cba4185fc262e7801dbbef17a2fd6c6e361be31305255ba4e11a1
SHA3-384 hash: 8bbc76b865a0adaebcca28d21d73232bdd4b5b0e55ef869f5cb1593f81311b74b7e296e2772dae3148b738d26de02a92
SHA1 hash: e35bcef1e9c9d8c6e48f5731d7307b6c109689df
MD5 hash: 297b1f567d73f7043733119dcbbb888b
humanhash: uniform-july-mexico-fanta
File name:Proof Of Payment.UUE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:235'001 bytes
First seen:2020-08-19 10:11:10 UTC
Last seen:Never
File type: uue
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:6p4pTfNr+aSZHUWeywz3SdJun/2MNQtsPyMZ:6+pTftnyU24Qwy6
TLSH 2B3423867718C062D54ED93832BFB336A59D52A49F91FD3E82C6939973084531B3F326
Reporter abuse_ch
Tags:AgentTesla uue


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: n1.iactive.co.za
Sending IP: 196.15.191.20
From: nats@iactive.co.za
Reply-To: provincial.finltd@contactoffice.co.uk
Subject: Proof of Payment
Attachment: Proof Of Payment.UUE (contains "sanley.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58911dc3272cba4185fc262e7801dbbef17a2fd6c6e361be31305255ba4e11a1/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 10:13:05 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lcir3qzhfs5edbp4eyxhqao3x3yxul6wy3rwdprrgbjflosocgqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

uue 58911dc3272cba4185fc262e7801dbbef17a2fd6c6e361be31305255ba4e11a1

(this sample)

AgentTesla

Executable exe 1d084044344ae5081c1e358485f9c03cc29b9691f2d17e3f39a845d0560dc4b7

  
Dropping
MD5 222dc354867d3b73fd7738282aa492d7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1d084044344ae5081c1e358485f9c03cc29b9691f2d17e3f39a845d0560dc4b7

Comments