MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 656bd90b410b23961038ac82c61b5abf99e8615841721ab0c2ff75715289fcaa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 656bd90b410b23961038ac82c61b5abf99e8615841721ab0c2ff75715289fcaa
SHA3-384 hash: 11ed441917d8ad76914c22f9e09918bfc75b8c92c9c432b44e9cfda7083c7c07e2a97d345e5e1344a6f15c4215af2a24
SHA1 hash: acb7f930b4acf20b74ecefd3ce1f227ae810b31d
MD5 hash: 526635b1f0d9ee4f62a617074d3ef3b5
humanhash: cat-emma-speaker-purple
File name:shipping document_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:584'215 bytes
First seen:2020-05-06 17:56:26 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:QF5JzkXMPh6McFyzLi+tUgE7pDGh1pJ9QGXipDR11H:w5Jzj+yNtUgE7pSprQGa9PH
TLSH 01C4238658C75A8692CAC05C2381E5B745C0211FF3AFAD5C5C2AAA4BD184EE4294FBF7
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: wearepumpkin.nh-serv.co.uk
Sending IP: 176.56.62.144
From: COSCO SHIPPING INC <support@coscoexpress.com>
Subject: ORIGINAL B/L DOCUMENT / PL
Attachment: shipping document_pdf.gz (contains "gunzipped")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

SecuriteInfo.com.Win32.Herz.B.16666.5657.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 01:31:55 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mvv5sc2bbmrzmebyvsbmmg22x6m6qykyifzbvmgc752xcuuj7sva._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 656bd90b410b23961038ac82c61b5abf99e8615841721ab0c2ff75715289fcaa

(this sample)

AgentTesla

Executable exe cebaa029ac534787f40aacdac6e5ad2383df34643cba1e92de862c081ce872f6

  
Dropping
MD5 db4036768609c28477e00908d9813462
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cebaa029ac534787f40aacdac6e5ad2383df34643cba1e92de862c081ce872f6

Comments