MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a308dbc184d5b623aa62406bd5fb947a8309cff2819c399e5c08333ca2fe8b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a308dbc184d5b623aa62406bd5fb947a8309cff2819c399e5c08333ca2fe8b4
SHA3-384 hash: 4816907886dd64137b3cf1eb0c247c301b09469d2698ca78acb83ef95ea5352e3cd0667ed94e1565c6aec36d72170d70
SHA1 hash: 275f3b83993259d01ba608702de22856bd289886
MD5 hash: 37eb4ce43e5776069f6cfd4e3ded8e82
humanhash: winter-ohio-mockingbird-connecticut
File name:Quote Inquiry PO6672.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:414'739 bytes
First seen:2020-08-08 17:59:40 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:e1ZYLbyOp+6sh9/M1aSpbzUqSD7NrDjJa:AZabLpMh9U1aQbQPD7tJa
TLSH DF9423B55D973E3578F439A370C2012207C7B1AA373E29C0E590E6857DD9AFA90C7AC6
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 163.com
Sending IP: 95.211.208.25
From: Deng Chun Peng <dengchunpeng521@163.com>
Subject: Company Profile : Quotation Inquiry
Attachment: Quote Inquiry PO6672.pdf.gz (contains "Quote Inquiry #PO6672.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a308dbc184d5b623aa62406bd5fb947a8309cff2819c399e5c08333ca2fe8b4/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tiyi3payjvnweovgeqdl2x5zi6udbhh7fam4hgpfycbthsrp5c2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9a308dbc184d5b623aa62406bd5fb947a8309cff2819c399e5c08333ca2fe8b4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 9a308dbc184d5b623aa62406bd5fb947a8309cff2819c399e5c08333ca2fe8b4

(this sample)

AgentTesla

Executable exe c7a4cb30492911fff0eb668a1b5d1bd4c97b968329a81e53ca164e4cc7f5d669

  
Dropping
MD5 48f205d0d7543068b26881dc4ab5a0f3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c7a4cb30492911fff0eb668a1b5d1bd4c97b968329a81e53ca164e4cc7f5d669

Comments