MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b75934fcb93a21a323d720504828acc2c80961f946f671d2ac59ec327cfda391. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b75934fcb93a21a323d720504828acc2c80961f946f671d2ac59ec327cfda391
SHA3-384 hash: 994159acb89b53a499e6e8b4f3bc51392bd1fc283f642633106284955635a2373fe1f7ef5b518d670fbea509b6d0d0a0
SHA1 hash: cb96be96db905dc5b8f06fc8c2dddf4a62c17959
MD5 hash: 2bddf58b368d53e9c027274d1e359cf5
humanhash: coffee-mike-florida-neptune
File name:Pasport ID.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:348'011 bytes
First seen:2020-05-13 06:10:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:vCDm3Q+H3uwcubG1Zcv5oG2aH4ZXYAenOeBHWMkPuaG+CQ:vCDmtHQubGEF20wI7l5aGE
TLSH A77423AFD0C184124FA89EC9704C6FE18FF68BA140C3C7A96F565647796E410EF17729
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gmail.com
Sending IP: 37.49.230.30
From: Mehmood Khan <mehmoodkhan839@gmail.com>
Subject: Mehmood Khan CV
Attachment: Pasport ID.zip (contains "Pasport ID.exe")

AgentTesla SMTP exfil server:
smtp.bnb-spa.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.fc.28680.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 06:37:15 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w5mtj7fzhiq2gi6xebieqkfmyleasypzi33hduvmlhwde7h5uoiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b75934fcb93a21a323d720504828acc2c80961f946f671d2ac59ec327cfda391

(this sample)

AgentTesla

Executable exe d159b66f0376a6dc5026fd4a827e12c77af9bf91d69e1c2a4766bafb236f344b

  
Dropping
MD5 42d488c070bc95506ce9b7a020c2b096
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d159b66f0376a6dc5026fd4a827e12c77af9bf91d69e1c2a4766bafb236f344b

Comments