MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 afe9aa767b8f1c2df3e2274644492dd4e563ab25f1f4d9ab38eeaf879fe64a8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: afe9aa767b8f1c2df3e2274644492dd4e563ab25f1f4d9ab38eeaf879fe64a8c
SHA3-384 hash: ff285b569ca7b85afe12b2a914c13c50eccb4b0276438992f66592b91983eab8ef1b4d915a9d040d5f95af112731d091
SHA1 hash: 9feebf9a0dff378d51477bdaa8c79729334dd999
MD5 hash: 21b43277d41baa7b0bf8f4675d01d9cb
humanhash: hotel-mars-magazine-failed
File name:W4kfrC2fM4LZyhi.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:506'510 bytes
First seen:2020-10-05 11:59:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:wRZuWX628FiY0DRlr7yyq0FJvMJRi6CSie:wRZxqUHyy/bvUCST
TLSH 2BB4231FCC6869D48D2AE51AFBED9B31B120196A60CE97320778637F504A3F8087B785
Reporter abuse_ch
Tags:AgentTesla Outlook zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: EUR05-AM6-obe.outbound.protection.outlook.com
Sending IP: 40.92.91.99
From: Luciano Ramos <luciano90533201@hotmail.com>
Subject: New Shipment
Attachment: W4kfrC2fM4LZyhi.zip (contains "W4kfrC2fM4LZyhi.exe")

AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/afe9aa767b8f1c2df3e2274644492dd4e563ab25f1f4d9ab38eeaf879fe64a8c/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v7u2u5t3r4oc347ce5deisjn2tswhkzf6h2ntkzy52xyph7gjkga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/afe9aa767b8f1c2df3e2274644492dd4e563ab25f1f4d9ab38eeaf879fe64a8c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip afe9aa767b8f1c2df3e2274644492dd4e563ab25f1f4d9ab38eeaf879fe64a8c

(this sample)

AgentTesla

Executable exe 6312da10a200d199338d238923be0a3f9ae4fa4ee20fde05d3875e22fe7a66bc

  
Dropping
MD5 7a73c76cc637d4d754eff280ce67d55b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6312da10a200d199338d238923be0a3f9ae4fa4ee20fde05d3875e22fe7a66bc

Comments