MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f84a683662f0654e8fbe85b5e2103d2703a62cb6adb240f89e776bafdf86ea5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f84a683662f0654e8fbe85b5e2103d2703a62cb6adb240f89e776bafdf86ea5a
SHA3-384 hash: 478dbeeb5c47033e262eb6f54923f2023030c8e086d956d1826805f1102654bb78d44b6ef4fa406152f359c113cff3d6
SHA1 hash: 9559a77455572af0df1f26f14232c5e8db03427e
MD5 hash: 4f0346d7c33e5be3f3e2a9b1718cb748
humanhash: golf-utah-neptune-shade
File name:Payment slip.uue
Download: download sample
Signature AgentTesla
Create hunting rule
File size:474'721 bytes
First seen:2020-07-21 18:42:34 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 12288:nUtCz3jfZs3yAsgibplWSm7halXQgb1j2h8hI4ljKQ079a:n1xs3yAs/tlUvKjSujb07U
TLSH 9EA423C9625636811BE36FC323AFC10B19079B4C995FAE86D6930C8CB85D3F5B644BC2
Reporter abuse_ch
Tags:AgentTesla uue


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic302-3.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.135.42
From: Sales manager <markwu586@yahoo.com>
Reply-To: Sales manager <markwu586@yahoo.com>
Subject: Fw: Payment Slip
Attachment: Payment slip.uue (contains "QXVa6NvH82Yaiva.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f84a683662f0654e8fbe85b5e2103d2703a62cb6adb240f89e776bafdf86ea5a/
Threat name:
ByteCode-MSIL.Trojan.MassLogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 18:44:08 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7bfgqntc6bsu5d56qw26eeb5e4b2mlfwvwzeb6e6o5v27x4g5jna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

uue f84a683662f0654e8fbe85b5e2103d2703a62cb6adb240f89e776bafdf86ea5a

(this sample)

AgentTesla

Executable exe 09be1d1130ddcf7aa7d321a4c70110c98a344812c818ed0cacfcbab916338034

  
Dropping
MD5 5b0f4ae46d79b6e8016b010d2d823e27
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 09be1d1130ddcf7aa7d321a4c70110c98a344812c818ed0cacfcbab916338034

Comments