MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 181f090439a6e417c0750084305e3002fff2b508cb1b32205debc99d36ec1dd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 181f090439a6e417c0750084305e3002fff2b508cb1b32205debc99d36ec1dd8
SHA3-384 hash: 54fcd431a630e67b98205385325957fd408e0b17504e571ca9857f915ddab6256b7562508a038ebcac32964dee55506b
SHA1 hash: f198fadcef163690aeafa4a354019c16b802dbae
MD5 hash: 87bb6075f4b24fa123878ed182a22ae3
humanhash: iowa-july-king-yellow
File name:gua de carga.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:826'270 bytes
First seen:2021-02-07 07:38:50 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 24576:9x6ZAblEy2zZHPIjSQqmKHeNvCP86her2ruWPUFMl:r6kE/IWuaeNvCPL0su3F0
TLSH 5B0533EF4A17E3AD83DDF572269DC4E078104C32B067A9A4E45F107AAC1FF2E9185B85
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.gasbod.info
Sending IP: 70.35.203.135
From: DHL EXPRESS <alfredo.soria@dhl.com>
Subject: Confirmación de envío DHL Express
Attachment: gua de carga.pdf.gz (contains "taXvSy21KGwmeTI.exe")

AgentTesla SMTP exfil server:
mail.prozero-d.com:587

AgentTesla SMTP exfil email address:
security01@prozero-d.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
215
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/181f090439a6e417c0750084305e3002fff2b508cb1b32205debc99d36ec1dd8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-07 07:39:06 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dapqsbbzu3sbpqdvaccdaxrqal77fniizmnteic55pez2nxmdxma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/181f090439a6e417c0750084305e3002fff2b508cb1b32205debc99d36ec1dd8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 181f090439a6e417c0750084305e3002fff2b508cb1b32205debc99d36ec1dd8

(this sample)

AgentTesla

Executable exe fca9c9be14541217929d625dd1efd04139b501d120a9a7a5b299fcd2a34973bf

  
Dropping
MD5 0cf1e4b8de0d3376eb4e3c050ed7e47d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fca9c9be14541217929d625dd1efd04139b501d120a9a7a5b299fcd2a34973bf

Comments