MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40887cba6b028ce4be3e4370400baea0d33037033714dbcbade6bc1414db885d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40887cba6b028ce4be3e4370400baea0d33037033714dbcbade6bc1414db885d
SHA3-384 hash: cd0735a4efb8818973ec3e3b4deb0d37ec227d48fe3d94f4edb19ced60eef5091e33ff41c3ab21af8ae264db2f77ebef
SHA1 hash: 41d002b9e43db78a151e9c50a55434330fbea066
MD5 hash: 582505242f657b5c0f27587f9845c119
humanhash: avocado-winner-two-wolfram
File name:RevPIorder1651-4.pdf.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:436'143 bytes
First seen:2020-06-19 06:07:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:TYCF3ePxuTFalyEqUrDhFg0f+k7hDW5hmTgj6bdywIfU:TYk3ePQT6vqUrDhy0xhDqh2CWywIc
TLSH 329423C1AC7A0DC5C04F0DDACB2C78B2696A56AF4A81952CD533A9C3D772B10FFC58A5
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: host.iteamweb.com
Sending IP: 209.59.138.164
From: CY LIM <cy.lim1@siigroup.com>
Subject: RE: New Order June 2020
Attachment: RevPIorder1651-4.pdf.arj (contains "RevPIorder1651-4pdf.exe")

AgentTesla SMTP exfil server:
secure231.servconfig.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis.9322.UNOFFICIAL
Create hunting rule

Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=icehzotlakgojpr6inyeac5oudjtanydg4knxs5n426bifg3rboq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 40887cba6b028ce4be3e4370400baea0d33037033714dbcbade6bc1414db885d

(this sample)

AgentTesla

Executable exe 4ea8fc31e7c4c74b0617f0786c0becbc39fadb91af884fe6971f4726c866225e

  
Dropping
MD5 70349cd53ccfddc31bfe214bb7a639ba
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4ea8fc31e7c4c74b0617f0786c0becbc39fadb91af884fe6971f4726c866225e

Comments