MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c95d4ca47d1ed91bb75f267372c8518d5c6b57ea7727625e9be7bee0ca97256a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c95d4ca47d1ed91bb75f267372c8518d5c6b57ea7727625e9be7bee0ca97256a
SHA3-384 hash: c4fa7405e651b9e35fb9a68cd4740973e4146d03eb53da9932fa7d8c308e58f550bb0cf883f4b6962230c59be2b97c0d
SHA1 hash: 6c3c492f42e3b9162a119ee83342ed022f085ca7
MD5 hash: 4db8dcfb52c2aeae75d4547197136bf6
humanhash: texas-tennessee-undress-december
File name:PO062020 - Italia.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:431'466 bytes
First seen:2020-07-03 06:39:57 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:s5qwliafmDoRRzGJXSiu/rnVuXbdR6bReaFrjs0pynZnhLsAV8ba7k85CgKYZ7GR:VwliPhu/hurdsRAnZ6K/PKyGSj4V6A
TLSH 2294233B57E4EFD0D83AEBB4147C1127100882ED0E75776D15A9D922308BB6E21BEB5B
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: Muhammad Ismail <hameedentr@cyber.net.pk>
Subject: Purchase Order 30-06-2020
Attachment: PO062020 - Italia.pdf.gz (contains "PO#062020 - Italia.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c95d4ca47d1ed91bb75f267372c8518d5c6b57ea7727625e9be7bee0ca97256a/
Threat name:
ByteCode-MSIL.Trojan.Avemariarat
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 06:41:04 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zfouzjd5d3mrxn27ezzxfscrrvogwv7ko4twexu3467obsuxevva._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz c95d4ca47d1ed91bb75f267372c8518d5c6b57ea7727625e9be7bee0ca97256a

(this sample)

AgentTesla

Executable exe 1ffe4da513e2e8c8dc6523b8d5d28eb8650e5ea13ed9c21366d9bf8f121924cc

  
Dropping
MD5 b8f6087b1750da048802fad99b3a927a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1ffe4da513e2e8c8dc6523b8d5d28eb8650e5ea13ed9c21366d9bf8f121924cc

Comments