MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b199d90244e26896dfde020b61405c77cbbe920bd8338e34580c1c9172de0e6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b199d90244e26896dfde020b61405c77cbbe920bd8338e34580c1c9172de0e6f
SHA3-384 hash: 73aba96052661a2c55047e9e09ca6f9fa1591ab87cea3b7f622e001ff02d5492d4c058503e2e4863915646913a877844
SHA1 hash: f2c1e28ed3d8ad37bf88e5571bfdef4fc8563e18
MD5 hash: dcfe0268954dbabfc6843368850a3e5c
humanhash: papa-alanine-rugby-berlin
File name:Due Invoice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:587'740 bytes
First seen:2020-05-27 06:40:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:BNpmge1rBhRAFoAwjrVTfifhOaKfE8PPVI7cauZpfFefz+QaMV:BNfeFjRAlwjrVTqqE8PP+caufFefyP0
TLSH E4C423E025016DB6DC680CB45D8EB6900AD9BC612FE45DA4E3B3D062377825B395CDFB
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: corp1.plreseller.com
Sending IP: 198.136.52.154
From: ppc@metecno.in
Subject: Past Due Invoice.
Attachment: Due Invoice.zip (contains "Due Invoice.exe")

AgentTesla SMTP exfil server:
mail.nathealth.ps:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BACKDOOR.Trojan.31361.17675.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 07:18:02 UTC
File Type:
Binary (Archive)
Extracted files:
33
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b199d90244e26896dfde020b61405c77cbbe920bd8338e34580c1c9172de0e6f

(this sample)

AgentTesla

Executable exe 70bdde448d83d5fabecafc0b3706fe1b732b64ee09d6d34886415688acf459d3

  
Dropping
MD5 9633a0555cbaa473c226d4d387c2cbe2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 70bdde448d83d5fabecafc0b3706fe1b732b64ee09d6d34886415688acf459d3

Comments