MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dadd72585de554121cb2a07bbfbabb3bd7754e7557157d0259f3040bac51a84f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dadd72585de554121cb2a07bbfbabb3bd7754e7557157d0259f3040bac51a84f
SHA3-384 hash: c79e0de5e1b044424962ce4341ee8b61414667afc92021a6ebde5faaf5f91af66e07256c532f65919033527708532ede
SHA1 hash: 9b56b56b9078bf71d8df1c68dc3c786fdc676a4b
MD5 hash: 429da4ce1f2f51270b4cdca14ff0e635
humanhash: stairway-virginia-one-salami
File name:IIW - UT234161112 - P.O.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:785'297 bytes
First seen:2021-02-24 07:05:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:MJen4UeAwDSxJtmijRaqB/2wWjyJNQdU9bPlU19eAgoqnIPUoxE12L8YM0+r6paR:I2UuLtt2ZgQm9Tl0eA1kIPNE12L87LrP
TLSH A4F423E7116F036CAA3E12A734654A3ACFDFD455DDE222ED08F4369CD484067272B2D6
Reporter abuse_ch
Tags:AgentTesla Yahoo zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic306-31.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.132.230
From: Avelyn Andrade <kravitzlenny80@yahoo.com>
Subject: REVISE QUOTATION IIW - UT234161112 - P.O
Attachment: IIW - UT234161112 - P.O.zip (contains "IIW - UT234161112 - P.O.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42850.6288.20751.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dadd72585de554121cb2a07bbfbabb3bd7754e7557157d0259f3040bac51a84f/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 07:06:21 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3loxewc54vkbehfsub537ov3hplxkttvk4kx2asz6mcaxlcrvbhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip dadd72585de554121cb2a07bbfbabb3bd7754e7557157d0259f3040bac51a84f

(this sample)

AgentTesla

Executable exe 958071879f7b081197e907c916e6a35a24a49c1d2c38b30ec7de0f5f66a1881b

  
Dropping
MD5 2808f6e5581e773ed0b39f9fac949127
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 958071879f7b081197e907c916e6a35a24a49c1d2c38b30ec7de0f5f66a1881b

Comments