MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73e437f8e4dcb169e2671181f80dc300a40efe62bf124f6d581f3f345a76d0e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73e437f8e4dcb169e2671181f80dc300a40efe62bf124f6d581f3f345a76d0e2
SHA3-384 hash: e44da0e34896864b653c3d612ec9b6ea4b796f59831c8d81eb5e6217cd5af549f790109727a5162e85c97f6c2f2cc6bd
SHA1 hash: 66c4e68290e68769415410fba2a73fd6ccc3e678
MD5 hash: 53983bfa8b685f8a06fffddd98a78633
humanhash: red-cat-river-gee
File name:Invoice Overdue46695626565646.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:427'994 bytes
First seen:2020-10-28 06:44:37 UTC
Last seen:2020-10-29 18:57:53 UTC
File type: z
MIME type:application/x-rar
ssdeep 6144:4eG3WcD8MyqZplV8glQ7sdHO69SgK38ZaAQY1EvlL3SFyjFPWDYakMWaIc0kgV:Q3Wiyyledgi8QAFWL3aqFm6zaI53
TLSH 9B94236B4B14BA5CC3C9A9D283B741F26A744FF537439D91C26296CDD8B3A4B67000BE
Reporter cocaman
Tags:AgentTesla z


Avatar
cocaman
Malicious email (T1566.001)
From: "Monicca<postmaster@vpsthree.xyz>"
Received: "from vpsthree.xyz (unknown [144.168.163.107]) "
Date: "27 Oct 2020 17:53:10 -0700"
Subject: "Past Due Invoice Unpaid"
Attachment: "Invoice Overdue46695626565646.z"

Intelligence

File Origin
# of uploads :
2
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/73e437f8e4dcb169e2671181f80dc300a40efe62bf124f6d581f3f345a76d0e2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-28 00:05:12 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=opsdp6he3sywtythcga7qdodacsa57tcx4je63kyd47tiwtw2dra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/73e437f8e4dcb169e2671181f80dc300a40efe62bf124f6d581f3f345a76d0e2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 73e437f8e4dcb169e2671181f80dc300a40efe62bf124f6d581f3f345a76d0e2

(this sample)

AgentTesla

Executable exe f030d590fcb9a74113d0e1e3b912bda207354996313320bee267f209be4a6129

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f030d590fcb9a74113d0e1e3b912bda207354996313320bee267f209be4a6129
  
Dropping
AgentTesla

Comments