MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4776841b763c714f81df4766c4fa0d5a182d4468362beee6f4bc83eb61d3ceeb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4776841b763c714f81df4766c4fa0d5a182d4468362beee6f4bc83eb61d3ceeb
SHA3-384 hash: 64f7c3740386e1562d5215dec882844c69fdeb031548745cac2b80619caa4656a39cf9ce843d7168e58827ad23b4a4c1
SHA1 hash: cd487ddcab656a0a963e7386d75a3a5fb8b8b45f
MD5 hash: 9545b92278ad83b597040e8ead213976
humanhash: ten-black-aspen-quiet
File name:Specification QT048585.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:689'929 bytes
First seen:2020-07-21 07:13:13 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:hxqhOpKiSyB07b6eaFGK7T0EbPUzYFLg4zv843crFVjQi1B2QzRsfJplaCchr8ez:hgMkr7bgUKX1PU8Vg4zv82crFVj/1BFn
TLSH 5BE43331DAEA4772B5D7E63E170C3A5A021921EFBB06D2D202A7C7FB7F1C95645900C9
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail0.714.gillonuminno.ml
Sending IP: 164.90.210.221
From: Sahid <sort@714.gillonuminno.ml>
Reply-To: brittonchim@daum.net
Subject: Offer / Quote Request
Attachment: Specification QT048585.gz (contains "gunzipped")

AgentTesla SMTP exfil server:
smtp.verio.com:587

AgentTesla SMTP exfil email address:
saratc@fourzoneme.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.52265.11427.5995.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4776841b763c714f81df4766c4fa0d5a182d4468362beee6f4bc83eb61d3ceeb/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 07:15:06 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i53iig3whryu7ao7i5tmj6qnlimc2rdigyv65zxuxsb6wyotz3vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4776841b763c714f81df4766c4fa0d5a182d4468362beee6f4bc83eb61d3ceeb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 4776841b763c714f81df4766c4fa0d5a182d4468362beee6f4bc83eb61d3ceeb

(this sample)

AgentTesla

Executable exe ebd23b0402ce1f9f8d45a37ec77fc89381869a3399aa2d405830e7eb05299ad3

  
Dropping
MD5 fae9357d084f85ea0605de88822b7b79
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ebd23b0402ce1f9f8d45a37ec77fc89381869a3399aa2d405830e7eb05299ad3

Comments