MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 245681907173d831519c90e6f7fc0586cced07ab0aeabdb603123aaf437d8c09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 245681907173d831519c90e6f7fc0586cced07ab0aeabdb603123aaf437d8c09
SHA3-384 hash: 4044305762d805eb6c202dcba069e6ade5c32d1f4f97a1ac873fb4f6f9e5bf2f85209e211d7867689c3ccf6850b7d270
SHA1 hash: 9394ede7bcd4c2a553559a96844d98b2f514f85c
MD5 hash: 0c63c72bc7a6df5ed84abc5f2090c061
humanhash: mexico-diet-iowa-enemy
File name:cargo waybill.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:359'309 bytes
First seen:2021-09-04 06:01:35 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:F7opusNGtF/HThnq6KEQ/gzQZtNMHFqP/8BJc94P1gLk9rhxOGzvCjSv/wwPt:doMsNSd1ni2U7NYqPkBJc94OkdHYmt
TLSH T119742334086E81D5EE9882F233734FBC84579A8EC3A609E7D8E6931D37959D1887FD06
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: "Courier Mail<Gasahiiiop@bbbridge.co.jp>" (likely spoofed)
Received: "from bizcloud-bbbridge.co.jp (unknown [157.245.61.140]) "
Date: "26 Aug 2021 02:16:47 +0000"
Subject: "rfq:shippment airway cargo bill "
Attachment: "cargo waybill.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
255
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

Win.Malware.Generic-9889811-0
Create hunting rule

SecuriteInfo.com.Trojan.Win32.Sabsik.FL.Bml.20625.26179.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.W32.AIDetect.malware1.26871.13679.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/245681907173d831519c90e6f7fc0586cced07ab0aeabdb603123aaf437d8c09/
Threat name:
Script-AutoIt.Trojan.AutoitInject
Create hunting rule
Status:
Malicious
First seen:
2021-08-26 02:13:54 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=erlidedropmdcum4sdtpp7afq3go2b5lblvl3nqdci5k6q35rqeq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
upx
Link:
https://tria.ge/reports/210904-grgh9ahahk/
Behaviour
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.85
Link:
https://yomi.yoroi.company/submissions/245681907173d831519c90e6f7fc0586cced07ab0aeabdb603123aaf437d8c09

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 245681907173d831519c90e6f7fc0586cced07ab0aeabdb603123aaf437d8c09

(this sample)

AgentTesla

Executable exe 27c7757a5432815c4867ebeeaa23152703af16520d73117a372e6371061fc1ee

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 27c7757a5432815c4867ebeeaa23152703af16520d73117a372e6371061fc1ee
  
Dropping
AgentTesla

Comments