MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 403cb1ca0a8d1b75f8af7b27a3b4ee1913a14300bc1ed521f83d541db73c86c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 403cb1ca0a8d1b75f8af7b27a3b4ee1913a14300bc1ed521f83d541db73c86c2
SHA3-384 hash: 21bb516b32a408793e480ae72b4173dd56e2a64a8f805efe7cbcc4650686bffebee430d0e9197276e19abc8a9bc76869
SHA1 hash: 34f657e3c4875ece7262d96bc1050383a51f50f5
MD5 hash: 6e74eacbfd2feb16c13c2b93743b89b7
humanhash: video-venus-oregon-fifteen
File name:New_Order2287.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:390'358 bytes
First seen:2020-07-16 08:20:52 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:1SdRPUb84U4cBH8Rv8WRjiDcuezSND857kToFPRA2yW3nCAw4v7aMUwCzb9f5Hx:1SHPy874KHu3RjduePc4CAwEa8C39RR
TLSH 138423A177B97245EC96961EDA87C00F4E13F8CF1673444FC2782F993BF09A6D8925A0
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.itrad3r.com
Sending IP: 45.140.168.119
From: Yoan POINTEREAU <info@euragent.it>
Subject: New Order
Attachment: New_Order2287.gz (contains "New_Order2287.exe")

AgentTesla SMTP exfil server:
mail.actionassist.co.uk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/403cb1ca0a8d1b75f8af7b27a3b4ee1913a14300bc1ed521f83d541db73c86c2/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-07-16 08:22:08 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ia6ldsqkrunxl6fppmt2hnhodej2cqyaxqpnkipyhvkb3nz4q3ba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 403cb1ca0a8d1b75f8af7b27a3b4ee1913a14300bc1ed521f83d541db73c86c2

(this sample)

AgentTesla

Executable exe 1a6f810afe2bfeebadb01ab981ec29c7f0f8283570ab3a550f6a6cc4634384e2

  
Dropping
MD5 2316d4f87db3d5d9040862d411914964
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1a6f810afe2bfeebadb01ab981ec29c7f0f8283570ab3a550f6a6cc4634384e2

Comments