MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae65a46b8a061342c487dd81518b1d818369b455d3284bd2c6aabbdfeca2c2b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae65a46b8a061342c487dd81518b1d818369b455d3284bd2c6aabbdfeca2c2b9
SHA3-384 hash: 2ea639f3d93a585467ec0ed55c2657590de34698b87b63faac04b2ba21cd777e5547013cd6b415a863dc5cdf7b3c9869
SHA1 hash: 4f38c78cd53db3fe0280e8ea0ea3bdd0db2c9206
MD5 hash: 6a08c0eb850c9ae97acfa37b94c61f48
humanhash: tango-happy-jersey-eleven
File name:RFQ20200447- CPM Yansab project.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:503'972 bytes
First seen:2020-06-07 07:52:55 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:yhjLPJnJLpG82GM/bq58KZ9AnHkTpybzu439URE2:ytrcGmO5/An4pybL9x2
TLSH 3AB423339F89E8F48CD945E8548CB7E7C1EE096240CB99581CA8CC6253E950AFEF719D
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.hoss-mecyberia.com
Sending IP: 45.95.169.170
From: SenthilKumar.s <info@hoss-mecyberia.com>
Subject: RFQ20200447- CPM Yansab project
Attachment: RFQ20200447- CPM Yansab project.gz (contains "RFQ20200447- CPM Yansab project.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-07 07:54:06 UTC
AV detection:
35 of 48 (72.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vzs2i24kayjufreh3wavdcy5qgbwtncv2muexuwgvk5573fcyk4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ae65a46b8a061342c487dd81518b1d818369b455d3284bd2c6aabbdfeca2c2b9

(this sample)

AgentTesla

Executable exe 919fa71c76a20b6a4dfa82c710ad189bfc1570725520fd430ed4cbe1410082b5

  
Dropping
MD5 437a4f78bbca62c2186a59168b573ae8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 919fa71c76a20b6a4dfa82c710ad189bfc1570725520fd430ed4cbe1410082b5

Comments