MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6a835b07460b57ecac289d9f18d2e0f87b4a0e2da12df8f4211923100d35ed2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara Comments

SHA256 hash: d6a835b07460b57ecac289d9f18d2e0f87b4a0e2da12df8f4211923100d35ed2
SHA3-384 hash: dae01a78f37ac2faccfbba44bfee0bfe5db797b817c7d1f6bde578e6fb8d160fb43285a88cc4229dd57ebc83b65e462a
SHA1 hash: ac4596cc57c836c8ce710ae57759472888de95cd
MD5 hash: 42f774c4da361b8ae7f8316468ce54ff
humanhash: ceiling-angel-utah-pip
File name:pro-forma invoice.zip
Download: download sample
Signature AgentTesla
File size:378'456 bytes
First seen:2020-06-30 08:46:25 UTC
Last seen:2020-06-30 10:33:53 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:Pf/utlyAQ6ZOitAujys9u/3EeyIFB8UyLg4MflzTTIWfV6cjzW518KsaOs:XG5OkAKyX/0eyaPyLafl3TIWfV66W5QQ
TLSH BF8423D085EC407559F113229A77450B02BDFD981CAA899F629317A830BFE07A7923EF
Reporter @abuse_ch
Tags:AgentTesla zip


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: samisec.com
Sending IP: 78.157.221.238
From: Accounts<sav@samisec.com>
Reply-To: Accounts<s.nsa41@hotmail.com>
Subject: pro-forma inv
Attachment: pro-forma invoice.zip (contains "pro-forma invoice.exe")

AgentTesla SMTP exfil server:
business41.web-hosting.com:587

Intelligence


Mail intelligence
Trap location Impact
CH Switzerland Low
Global High
# of uploads 2
# of downloads 24
Origin country FR FR
ClamAV SecuriteInfo.com.Generic.mg.441166bc629c6bce.10326.UNOFFICIAL
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/d6a835b07460b57ecac289d9f18d2e0f87b4a0e2da12df8f4211923100d35ed2/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Agensla
First seen:2020-06-30 08:48:05 UTC
AV detection:20 of 46 (43.48%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:Virustotal results 12.12%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d6a835b07460b57ecac289d9f18d2e0f87b4a0e2da12df8f4211923100d35ed2

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments