MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a46e5b44fa74bf174dbef223020ab42317e07b3bba307c0b2199b5a82b7ed924. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a46e5b44fa74bf174dbef223020ab42317e07b3bba307c0b2199b5a82b7ed924
SHA3-384 hash: f91225382c60e5870b7864db9846c60b054e0ee5e8a1a0027bcf3da548bfd58f90f82c9b81fd8b8f39a0c07bd8d49fb2
SHA1 hash: ff494282bdc50fecb69abace217acf106990a084
MD5 hash: 220cd43d125fa26b987e59381c79f8d4
humanhash: whiskey-rugby-florida-august
File name:Ord-suzhou64689_Pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:425'237 bytes
First seen:2020-07-24 11:13:19 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:EnGADIDoqM2B0XnC6fV/KoRVAHdHYBAlzMRyC:EntDIDoqxKnVSogL8yC
TLSH 419423447802BB7C94F80D616BB4E12C6FB036659AD61569FC0B811FC57F29BB22EE34
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp64.iad3a.emailsrvr.com
Sending IP: 173.203.187.64
From: Alice <cavelti@rof.net>
Subject: Fw: New Order-8765434567
Attachment: Ord-suzhou64689_Pdf.z (contains "Ord-suzhou64689_Pdf.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a46e5b44fa74bf174dbef223020ab42317e07b3bba307c0b2199b5a82b7ed924/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-24 11:15:07 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=urxfwrh2os7rotn66irqecvueml6a6z3xiyhyczbtg22qk363esa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a46e5b44fa74bf174dbef223020ab42317e07b3bba307c0b2199b5a82b7ed924

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z a46e5b44fa74bf174dbef223020ab42317e07b3bba307c0b2199b5a82b7ed924

(this sample)

AgentTesla

Executable exe 8062bfd89bed5bf003bb7cbeb5caf6b9136158dcc499e60ea161b896b2d78ce5

  
Dropping
MD5 fedea4b801f50850539f8a31a1033933
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8062bfd89bed5bf003bb7cbeb5caf6b9136158dcc499e60ea161b896b2d78ce5

Comments