MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ab8d3be11d1de3a40a607953c2717d3892a8eaad26fbf4c3f9ac5465eec9db5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ab8d3be11d1de3a40a607953c2717d3892a8eaad26fbf4c3f9ac5465eec9db5
SHA3-384 hash: a894e65dafc0b869af643c2061b2775899653425afa973b1af891978e6077a519d1dd87c1bade821301b5c4bc0df9b33
SHA1 hash: 01c48c0844dbd631246670ea8cfecf6c99ea2601
MD5 hash: 8f7971c9ceac7304a86206b5d5bc3cb6
humanhash: venus-papa-sixteen-romeo
File name:GEODIS Turkey 009273_9372838G8373,pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:638'054 bytes
First seen:2020-10-05 11:22:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:8c1SPJ0PJKxPj97Mxbxup7RM/Y4wqvuXdtURoKKh3sbdnvat2SYxtUKjM:x1SGChSUp7RP4wqkUyGditJYPQ
TLSH 4ED423321DFCD13AB1491E10D97FDEBB0D6603DEDE5406CAD618C3230E6396562A94BB
Reporter abuse_ch
Tags:AgentTesla geo TUR z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: neti-logistics.com
Sending IP: 185.132.53.82
From: Burcu GÜLSEÇGIN <office@neti-logistics.com>
Subject: TURKEY ORDER
Attachment: GEODIS Turkey 009273_9372838G8373,pdf.z (contains "GEODIS Turkey 009273_9372838G8373,pdf.exe")

AgentTesla SMTP exfil server:
mail.aquagas.biz:587

AgentTesla SMTP exfil email address:
admin@aquagas.biz

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ab8d3be11d1de3a40a607953c2717d3892a8eaad26fbf4c3f9ac5465eec9db5/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 10:53:28 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dk4nhpqr2hpduqfga6ktyjyx2oesvdvk2jx36tb7tlcumxxmtw2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1ab8d3be11d1de3a40a607953c2717d3892a8eaad26fbf4c3f9ac5465eec9db5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1ab8d3be11d1de3a40a607953c2717d3892a8eaad26fbf4c3f9ac5465eec9db5

(this sample)

AgentTesla

Executable exe f23c845c6c2450e632e8894be99fe3eb8a6a42eedc749c593431665c18e37d03

  
Dropping
MD5 ad5cab009234925cccf7b5392f2c8e0f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f23c845c6c2450e632e8894be99fe3eb8a6a42eedc749c593431665c18e37d03

Comments