MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 664ab66ce830bbfe7b4f5c88f0ad03fcc13f838dcbfead80ceb8b9673c4eb48d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 664ab66ce830bbfe7b4f5c88f0ad03fcc13f838dcbfead80ceb8b9673c4eb48d
SHA3-384 hash: e52ec4651cb301d116424fcce65a9c609bbd98f61e5bca92f4665b4cecc134fbc95823139e433de34085a1810e67660f
SHA1 hash: de4903a8071945f5af05c3a549c7c39522dc45a4
MD5 hash: a6e949cb7d32b47231dc76bb67b5eab7
humanhash: johnny-fanta-uranus-twenty
File name:4567923484742.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:504'149 bytes
First seen:2020-06-02 10:54:20 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:6A2+7mlNmMqkacAQErv99qjcD5Zsq6yn7I6vd6NTmJ7WPFbTS6aDoHwhq:ZmXQO2vPqjctZ1HdMYJiPFfS/oHws
TLSH 2CB4233A29F81B0C3658FBD662EDB14A57C01DD035592F86B581880ACFC3E9D2DD6DE8
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: matcothailand.com
Sending IP: 185.222.58.111
From: MT-Chayada <chayada@matcothailand.com>
Subject: RE: MAS SQ113310 RE: 1200004813- Supply of replenishment for maintenance spare parts ( 200236_PP )
Attachment: 4567923484742.pdf.z (contains "4567923484742.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Boilod
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 03:22:00 UTC
AV detection:
14 of 31 (45.16%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mzflm3higc57462plsepblid7tat7a4nzp7k3agoxc4wopcowsgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 664ab66ce830bbfe7b4f5c88f0ad03fcc13f838dcbfead80ceb8b9673c4eb48d

(this sample)

AgentTesla

Executable exe c63cb2c82dfd94ac6a40c91d5ebdd5d00fe6f2ff0dd785af1f312eff9872861f

  
Dropping
MD5 0c81d00b42bb6bf7d9e6e784297524b2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c63cb2c82dfd94ac6a40c91d5ebdd5d00fe6f2ff0dd785af1f312eff9872861f

Comments