MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16561dedb2c5146efd6710770cfa964ef893ac35680fa922a83fce33fd02d5f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 16561dedb2c5146efd6710770cfa964ef893ac35680fa922a83fce33fd02d5f2
SHA3-384 hash: 19b8dc82ddeaa8fbe0ace9091067e486bf03460323a156b2aeaf14ef8c99eeb59f73d29060ec492a7397dbb195f0e190
SHA1 hash: 35d0719633afeab9a73f632e4c4c467ddc3dd33d
MD5 hash: 399f38581abd265f30fd84345e6c51a3
humanhash: rugby-stairway-california-potato
File name:orden de compra_pdf___________________________________.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:538'816 bytes
First seen:2020-08-17 19:08:47 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:UtxTbx7efBA/7RP/Ut19BJpAc+LhPhudnKvX+3wvi5KTSnVxS/gUFVynjgOY+yUW:4TvK39P3+LhZucvX+3wvi5pVcYZnj1rq
TLSH 97B42300A7170C493FBABF3AA32156EC4CDD5EC8E5295439B6062523782249DDFE9FE4
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: auto-deal.gr
Sending IP: 95.211.208.25
From: Nicholas Rivecca<xasapi@auto-deal.gr>
Subject: RE: orden de compra
Attachment: orden de compra_pdf___________________________________.gz (contains "orden de compra_pdf___________________________________.exe")

AgentTesla SMTP exfil server:
smtp.erneralduae.com:587

AgentTesla SMTP exfil email address:
jerryforward@erneralduae.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/16561dedb2c5146efd6710770cfa964ef893ac35680fa922a83fce33fd02d5f2/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 12:32:30 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=czlb33nsyukg57lhcb3qz6uwj34jhlbvnah2sivih7hdh7ic2xza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/16561dedb2c5146efd6710770cfa964ef893ac35680fa922a83fce33fd02d5f2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 16561dedb2c5146efd6710770cfa964ef893ac35680fa922a83fce33fd02d5f2

(this sample)

AgentTesla

Executable exe d805b37ff430c59fbac19f5ccbbaa2eec750849def87f05c7bf14e68f8531416

  
Dropping
MD5 4d6c75fe32792bc5a638fdb04bf294e1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d805b37ff430c59fbac19f5ccbbaa2eec750849def87f05c7bf14e68f8531416

Comments