MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 877b3f26f8e8ca3c23dfdffa4b7b7ad7b33879012e5769976f909fd19d36ae0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 877b3f26f8e8ca3c23dfdffa4b7b7ad7b33879012e5769976f909fd19d36ae0f
SHA3-384 hash: f0bc002845c68454a5129b53537fa16baf0f78fe5e86719cc65e0db6aa7f62a94c78680974cda60135bfdc60ad795cef
SHA1 hash: 6bd1a4d49afe5eb3f777122cfda9337276b65d30
MD5 hash: d17c2defb8d2ed557021b5b561edc0fd
humanhash: alaska-fillet-lactose-robin
File name:paid invoice slip.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:370'866 bytes
First seen:2020-06-29 07:33:39 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:ORiXphAVXaWECPNCKCSeaBYMaZbHmE55SRTbs/iT+8bP3340BbUqR+hUcaxBsUa:ORYXWECPSataZbH155SRTba873owUqRc
TLSH 5174236B7586632E6157CD7F81E0F785B31A5B1A221BA223F9195F37A8CE4C1F11600F
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: alkuhaimi.com
Sending IP: 209.58.149.71
From: Accounts Department <rud-division@alkuhaimi.com>
Subject: paid invoice
Attachment: paid invoice slip.z (contains "paid invoice slip.exe")

AgentTesla SMTP exfil server:
mail.sensar-light.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/877b3f26f8e8ca3c23dfdffa4b7b7ad7b33879012e5769976f909fd19d36ae0f/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 07:35:10 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q55t6jxy5dfdyi67375ew63226ztq6ibfzlwtf3pscp5dhjwvyhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 877b3f26f8e8ca3c23dfdffa4b7b7ad7b33879012e5769976f909fd19d36ae0f

(this sample)

AgentTesla

Executable exe 9b45ea2eae4824986248b5af2e350562d4f43bc22975497b19f4e8141fb9bcb7

  
Dropping
MD5 0173bd00a7d651b0caf45ad4d45ecb14
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9b45ea2eae4824986248b5af2e350562d4f43bc22975497b19f4e8141fb9bcb7

Comments