MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66135ea7def59524de7b42d490e910462176f90b831bd0996814b37478996e62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 66135ea7def59524de7b42d490e910462176f90b831bd0996814b37478996e62
SHA3-384 hash: 33fc6c774de57a88dc50587a880a346141709edaee9657d6ef3e2b68cbcbaa1e75ac07c5b242dc7ca123fbc4ba26165b
SHA1 hash: 7457609eebf541513d5dda2b040e6118db0d42c0
MD5 hash: f576be1072c452f7874a32ff6cb29212
humanhash: black-burger-lactose-green
File name:RFQ-PRO NO. SER-M 212 21420.xls__.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:252'187 bytes
First seen:2020-09-02 06:14:33 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:u4FQpbEtjZ+RA59m7A7kB0+EAzSKNVI+xoIJIyNQxu1cKjzoz:Qpwtjcg07A7cmB+xFJ3QxAjz4
TLSH 653422AC9237705C81FD2CE147AAB86D14DF76C7E20F46671A24FE21D9390E43563D68
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Yanis Kolios <inquiry@507.drxvivo.ml>
Subject: RFQ-PRO NO. SER-M 212 & 214/20
Attachment: RFQ-PRO NO. SER-M 212 21420.xls__.gz (contains "RFQ-PRO NO. SER-M 212 21420.xls__.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/66135ea7def59524de7b42d490e910462176f90b831bd0996814b37478996e62/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-09-02 05:51:48 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=myjv5j666wksjxt3ilkjb2iqiyqxn6ilqmn5bglicszxi6eznzra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/66135ea7def59524de7b42d490e910462176f90b831bd0996814b37478996e62

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 66135ea7def59524de7b42d490e910462176f90b831bd0996814b37478996e62

(this sample)

AgentTesla

Executable exe e14485ceea75d472b156c60312308d431fbd7bf1fbc0b4994fb47c05b79c6ddf

  
Dropping
MD5 9704fb19bf08b5ca543cd779827cd706
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e14485ceea75d472b156c60312308d431fbd7bf1fbc0b4994fb47c05b79c6ddf

Comments