MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 072feb4045aa04622b06d9a5fd96c023bd16262fd9a022f0fd4ee01954a20edf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 072feb4045aa04622b06d9a5fd96c023bd16262fd9a022f0fd4ee01954a20edf
SHA3-384 hash: 2e4acdd04f597cde37f4a6946043d3dd4dca2dd6789f2175107e962c3cf99ff0045cd150171d84a265c71f63a0a9ec42
SHA1 hash: 272b28adcf2afc341e97b35cd9ca55a7f79aece7
MD5 hash: 24017801025462684803bf0d46ed8486
humanhash: artist-tango-arkansas-july
File name:proforma invoice-pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:394'118 bytes
First seen:2020-10-02 09:16:43 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:fRyTiwWEk47AAwWYztSngCMQKy+ENIICe/WW48BcL7Kdst4PZcEKf9Katg:JyTUEeAwW+Q24He4PZzw+
TLSH E7842368CDBDC4069EF5AF87C990103BBD8A59543C7E1D9BE28D4E304665B4E8E042FD
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sina.com
Sending IP: 209.58.149.66
From: account <joy_acctdpt@sina.com>
Subject: Change in proforma / PI#20081602
Attachment: proforma invoice-pdf.gz (contains "proforma invoice-pdf.exe")

AgentTesla SMTP exfil server:
smtp.sankapatrol.com:587

AgentTesla SMTP exfil email address:
info@sankapatrol.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/072feb4045aa04622b06d9a5fd96c023bd16262fd9a022f0fd4ee01954a20edf/
Threat name:
Win32.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-02 07:15:05 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a4x6wqcfvicgekyg3gs73fwaeo6rmjrp3gqcf4h5j3qbsvfcb3pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/072feb4045aa04622b06d9a5fd96c023bd16262fd9a022f0fd4ee01954a20edf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 072feb4045aa04622b06d9a5fd96c023bd16262fd9a022f0fd4ee01954a20edf

(this sample)

AgentTesla

Executable exe 09887c5989671c04896df3192f60ef3a0eeb27bae96718757dc2d3e2ffbe801d

  
Dropping
MD5 35cf9ebedc1a294754f316b3b7a1ce14
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 09887c5989671c04896df3192f60ef3a0eeb27bae96718757dc2d3e2ffbe801d

Comments