MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be77d5349ce4e1e3043568a57689307603e4a42aee09eafcac4cbe222ee2eece. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be77d5349ce4e1e3043568a57689307603e4a42aee09eafcac4cbe222ee2eece
SHA3-384 hash: 6c59ab0486043ed1c1810e61b58aea7ffc16a8470d694d35cab43f311cacbd4954c3eb75d32c86bad3fff6bd75852abd
SHA1 hash: 19dcd61257af20fdc74e1ee4cace87b19e4f0ac3
MD5 hash: 4d4cd9f5b6570e6b8957e81817c50468
humanhash: gee-finch-neptune-mockingbird
File name:PO No. LTPCHN20010.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:338'829 bytes
First seen:2020-08-13 09:22:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:UYWJ63HBodv27DX2Gq1uha74wGnrrVC2xmXrglVSUR1tr9ja9wWK:dWJmh1aNqa7kn3hxmklVSKtEK
TLSH 2674231C2B8D3F527C75579013A70BB846E912A58342FBC5FF886027AB51BEF74A690C
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: folla.com
Sending IP: 155.94.136.61
From: Reena Castelino <hazel@folla.com>
Subject: PO No. LTP/CHN/20/010 - AARTI 32.
Attachment: PO No. LTPCHN20010.xz (contains "PO No. LTPCHN20010.exe")

AgentTesla SMTP exfil server:
mail.heybetdeger.av.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.1137.13440.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be77d5349ce4e1e3043568a57689307603e4a42aee09eafcac4cbe222ee2eece/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 09:24:07 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xz35kne44tq6gbbvncsxncjqoyb6jjbk5ye6v7fmjs7celxc53ha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/be77d5349ce4e1e3043568a57689307603e4a42aee09eafcac4cbe222ee2eece

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip be77d5349ce4e1e3043568a57689307603e4a42aee09eafcac4cbe222ee2eece

(this sample)

AgentTesla

Executable exe c2af32087beb20ac52dd19d5cd1f2a389bb58e424790a0c820dd450cf0c48847

  
Dropping
MD5 dd9395eef29c348765b93422605b7f49
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c2af32087beb20ac52dd19d5cd1f2a389bb58e424790a0c820dd450cf0c48847

Comments