MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83fedf68307379d8bf393a4abbbc53d07567706e11645d4ffdda64a9d625d78d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 83fedf68307379d8bf393a4abbbc53d07567706e11645d4ffdda64a9d625d78d
SHA3-384 hash: 5d0f0246eef1dde6370c0cddfbb5f6ad77c486d5d973439d16da9a5c69186789721d91075fde0540a9ebd0d48b651cc2
SHA1 hash: ecf6bbf7b25c1244dd0ee74c2d1c5ba72d2ac354
MD5 hash: c46a24956267466e5dfc8f5380430cde
humanhash: cola-king-johnny-fifteen
File name:Doc_160820202202.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:403'309 bytes
First seen:2020-08-16 14:04:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:iMgLQ1cvvHuJUuGgxmsqG8Ly0r7nfVH2MQqu6T2d+N/yHgQ43KzIyCnNGmy+67Bc:9lm0wssPPVHFzz6xpMnkmoLOky
TLSH 75842371670138CF8AE94BD4B53F8A3506F1FFBE802E3C88E05D43D657542258E5EAA6
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server118.firstdns.net
Sending IP: 87.236.211.104
From: Danielly Machado<info@vortex-intl.cf>
Subject: New order #7310
Attachment: Doc_160820202202.zip (contains "BoN1F4IwB4ATFo1.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.81f231d6a9432096.13307.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/83fedf68307379d8bf393a4abbbc53d07567706e11645d4ffdda64a9d625d78d/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qp7n62bqon45rpzzhjflxpct2b2wo4docfsf2t753jsktvrf26gq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/83fedf68307379d8bf393a4abbbc53d07567706e11645d4ffdda64a9d625d78d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 83fedf68307379d8bf393a4abbbc53d07567706e11645d4ffdda64a9d625d78d

(this sample)

AgentTesla

Executable exe 9b35a1eab3bddb51f9571b67a8d679c7db0af207a938f428870e10eae43e00f2

  
Dropping
MD5 81f231d6a9432096999f0cd7e4ec0d72
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9b35a1eab3bddb51f9571b67a8d679c7db0af207a938f428870e10eae43e00f2

Comments