MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73ad2fabb61ba1561b0697236168284f30128d90ce6b63300fdf44766711c0bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73ad2fabb61ba1561b0697236168284f30128d90ce6b63300fdf44766711c0bc
SHA3-384 hash: e4dc70a44a64fbe0e07c8d64245fb149f4f0b9ed5ec68712d583fba52871101f114e5894475c97d9e4dcb8e6d35f3042
SHA1 hash: 3c30f7b158178a519aff72aab3f3e608d1539fbf
MD5 hash: de7c3e3e1c170407ef8072068c8a0e54
humanhash: ack-sink-sixteen-uranus
File name:po6446.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:422'410 bytes
First seen:2021-06-23 05:25:02 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:GGi2wS1H+xfZ0ozkD/CumFMJC7NVjgZUonbgywAQmp1Luhfx6Jbmh8:GTg1afatgx7NVjjo0o3nmh8
TLSH 42942363A6B8AE9CBC34E918CD391236DAAFD0308DB3163B3249CC8774545F5C66466B
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email (T1566.001)
From: "<dberkowitz@madisoncap.com>" (likely spoofed)
Received: "from madisoncap.com (unknown [147.124.211.69]) "
Date: "22 Jun 2021 17:24:10 -0700"
Subject: "po"
Attachment: "po6446.z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/73ad2fabb61ba1561b0697236168284f30128d90ce6b63300fdf44766711c0bc/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-23 05:25:15 UTC
File Type:
Binary (Archive)
Extracted files:
97
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oows7k5wdoqvmgygs4rwc2bij4ybfdmqzzvwgmap35chmzyryc6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/73ad2fabb61ba1561b0697236168284f30128d90ce6b63300fdf44766711c0bc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 73ad2fabb61ba1561b0697236168284f30128d90ce6b63300fdf44766711c0bc

(this sample)

AgentTesla

Executable exe 4ce344180332c420d2c2340151e359e516435dd993276ee0b7a351c3de5664b5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4ce344180332c420d2c2340151e359e516435dd993276ee0b7a351c3de5664b5
  
Dropping
AgentTesla

Comments