MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 129c50578bda2ce24351d0f483cb0aa60f2c8a4432980d6572f74a2a15a4c90a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 129c50578bda2ce24351d0f483cb0aa60f2c8a4432980d6572f74a2a15a4c90a
SHA3-384 hash: 5959d15ff3560b2b9697fa78781c7451d189d95ae686ac26008a3a12d2a21172891f1b5c0fc6bae4ae362d8cf783906f
SHA1 hash: 97eceb8ad43c10e4ad644117c34eaf1e500a1dff
MD5 hash: 9ca261ca279f714d1b04e656686dc704
humanhash: black-spring-dakota-nebraska
File name:Document.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'090'563 bytes
First seen:2020-06-01 19:53:52 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 24576:CfRNotMk1TdWf8T+TSKcGi/j71cOgMenLcYPgoA/QzdIColSp4G:CfRWMk1zT++KovuOgMe9IoA/COColc
TLSH 9C35339A9E26D0EDA0511E7F51DEB01FAE838887B0C0C1D6CD49D2BDCD7A9DAC3091B5
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: interserve-me.com
Sending IP: 156.96.58.98
From: Hakkim.N <Hakkim.Nazarud@interserve-me.com>
Reply-To: Hakkim.Nazarud@interserve-me.com
Subject: Please reply ASAP_UGENT.
Attachment: Document.pdf.gz (contains "Document.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 19:13:00 UTC
AV detection:
13 of 31 (41.94%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ckofav4l3iwoeq2r2d2ihsykuyhszcsegkma2zls65fcufnezefa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 129c50578bda2ce24351d0f483cb0aa60f2c8a4432980d6572f74a2a15a4c90a

(this sample)

AgentTesla

Executable exe 8fdc81efa6fd138b9f7dd2e95e957c5ffd1e1d31ed2d588b531433f4915f8ed2

  
Dropping
MD5 c3d24f1e6b0a84331cc31552ce197ab7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8fdc81efa6fd138b9f7dd2e95e957c5ffd1e1d31ed2d588b531433f4915f8ed2

Comments