MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5040f5d8da4db91e2297c3e24b9d7538600f2beffa427bdfc8d9cfb0682d9996. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5040f5d8da4db91e2297c3e24b9d7538600f2beffa427bdfc8d9cfb0682d9996
SHA3-384 hash: 13eef4f092676b76a4407929734c724a1a5b60ecbf9c66d1cc4d0b33d2dc4d896275b5ce9eb4072ea821809c107ed36b
SHA1 hash: 4b262dc67f04635b6088be29b1c30ac6efe15939
MD5 hash: 89d231e4029c958a7617db28a41fb06f
humanhash: august-avocado-quiet-ceiling
File name:Quote-DOC-07192020-239485.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:396'476 bytes
First seen:2020-07-28 13:20:24 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:yH9itbRrt89KTkHktdtPw2w111A+irM8R/0WTgj8E8:g4tJT8ktTPlw1NAfWWTgj8t
TLSH 4484231D032463E38762A31704A7C053EB2AEBA649637C52072AA6DBB99537F58B11DC
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: Afnan El-Khatib <hameedentr@cyber.net.pk>
Subject: Request for Quotation: Quote-DOC-07192020-239485
Attachment: Quote-DOC-07192020-239485.pdf.gz (contains "Quote-DOC-07192020-239485.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Gen.Variant.Zusy.310100.31972.28738.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5040f5d8da4db91e2297c3e24b9d7538600f2beffa427bdfc8d9cfb0682d9996/
Threat name:
Win32.Trojan.DataStealer
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 13:22:07 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kbaplwg2jw4r4iuxyprexhlvhbqa6k7p7jbhxx6i3hh3a2bntgla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5040f5d8da4db91e2297c3e24b9d7538600f2beffa427bdfc8d9cfb0682d9996

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 5040f5d8da4db91e2297c3e24b9d7538600f2beffa427bdfc8d9cfb0682d9996

(this sample)

AgentTesla

Executable exe d09b3d3ddff303f38d76bc615b777169e2d3b672647a6e54bf99490db0efc083

  
Dropping
MD5 a792b73da8ce29e0dd05d168eba833e2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d09b3d3ddff303f38d76bc615b777169e2d3b672647a6e54bf99490db0efc083

Comments