MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92437fbc2f16f29fe04dd9eec572502fb1e58defd334fcc4d64e573e448c12f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92437fbc2f16f29fe04dd9eec572502fb1e58defd334fcc4d64e573e448c12f4
SHA3-384 hash: aa8bc154e439c5c04d1af009bc4ed1730e3174a79acbd55115df2a01e6e3a920c0b01c944b9ac7822907f57cb9cd1ccf
SHA1 hash: 332b976b3b909642a18e1a630b77d50a9a9e2223
MD5 hash: 29f3bcfcd63ec23289b5362d2f7989d7
humanhash: fish-gee-utah-three
File name:Document-PI203498.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:593'961 bytes
First seen:2020-08-12 19:17:32 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:TV7ixaCwoT4cIXIdmRZiJqkq0liw4u2Bz2AUDSZlyZ:xthlcLmROq0lJN2ByAUDClyZ
TLSH E8C423B3E73834FE6A3714545EB32A9E2DE6F125A508D3A6438F84605F69F506FA0303
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hotmail.com
Sending IP: 95.211.208.25
From: Wanda Rodriguez <atcorporation@hotmail.com>
Subject: AW: Re : Order BL#ZIMUGZH0084768 / Port De Barcelona Spain
Attachment: Document-PI203498.pdf.gz (contains "Document-PI#203498.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/92437fbc2f16f29fe04dd9eec572502fb1e58defd334fcc4d64e573e448c12f4/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 18:41:59 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sjbx7pbpc3zj7ycn3hxmk4sqf6y6ldpp2m2pzrgwjzlt4remcl2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/92437fbc2f16f29fe04dd9eec572502fb1e58defd334fcc4d64e573e448c12f4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 92437fbc2f16f29fe04dd9eec572502fb1e58defd334fcc4d64e573e448c12f4

(this sample)

AgentTesla

Executable exe 0fbc9c7fd0d2dc46b01887d635c8b8be1838151a46fa392a6e7e77e7aeb63d2f

  
Dropping
MD5 ac816d432fa5ff81cb5ec1676281d7e2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0fbc9c7fd0d2dc46b01887d635c8b8be1838151a46fa392a6e7e77e7aeb63d2f

Comments