MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3c83ace85a98c193cb94947ca21c9dc5a47a6155525b2b7a49450fe2e679218. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3c83ace85a98c193cb94947ca21c9dc5a47a6155525b2b7a49450fe2e679218
SHA3-384 hash: 207c2873ef84da28e766578a7cdee7da707cf953d574f5c54f8bb7eb35edc1dc8bf751a3f9bbfd76f47be5163621afe9
SHA1 hash: f8db56db31dc08f1ee1d5e5e6fc253c11f496463
MD5 hash: 2f97b28a6431f62fa8f1b45cd2bcef67
humanhash: chicken-lake-tennessee-high
File name:Purchase Order ASPG-2 GP 016937.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:357'762 bytes
First seen:2020-05-13 06:50:53 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:6ZRBTcBX8ucjIeqCl8aC2x8RiU/R/LQWJwiPwolxwZ0WUWOAx499pGWO6:6FweucjDlRqcoMJ4WQ9eW7
TLSH 2674239A0511B901E8CE89D3D9BF4E3CA84B706DF4FD9CCA610418A9A235B7E3F4579C
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.power-vvin.com
Sending IP: 64.52.84.166
From: Dawn Brown <sales@power-vvin.com>
Subject: Purchase Order ASPG-2 / GP 016937
Attachment: Purchase Order ASPG-2 GP 016937.gz (contains "Purchase Order ASPG-2 GP 016937.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 15:50:18 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=upedvtufvggbspfzjfd4uioj3rnepjqvkus3fn5esrip4lthsima._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz a3c83ace85a98c193cb94947ca21c9dc5a47a6155525b2b7a49450fe2e679218

(this sample)

AgentTesla

Executable exe 3691ad7dac5edf3fdf42a9f5b1324fa2f00839a2ec4a83cc1accd845f3364932

  
Dropping
MD5 3112f50d2202e5d2ab2ced1dcdc0a8fd
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3691ad7dac5edf3fdf42a9f5b1324fa2f00839a2ec4a83cc1accd845f3364932

Comments