MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4060f04322ea7b24feefa7541c0e8873791ffa0955af90a2dd8b8a6808c8bb6d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4060f04322ea7b24feefa7541c0e8873791ffa0955af90a2dd8b8a6808c8bb6d
SHA3-384 hash: 693a50f2010c018d45d7184a2aa59256913a7b8ae22c84ceb4918cb8b29869a1f9a4df9695c414844bfdc5f4d676d611
SHA1 hash: a1a1ec10cf0bd1cb79b192b9aa3cf201e58db37f
MD5 hash: 24d8f23e04d900a392772771c5b78b77
humanhash: alpha-asparagus-high-ohio
File name:TTSLIP122020.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:896'505 bytes
First seen:2020-12-22 08:48:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:kP4I030qOX9gEFbA7YZb24TBNwNVpTUY3cro:/9bONg+b6YZ9yVJUY3cro
TLSH 611533A0ADDFC4292A6700C317F46F9A536207F607F6A3F1460DCD1972BE09259AD5E3
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: servers.com
Sending IP: 1.46.131.141
From: Margaret Yehuda <secureserver@servers.com>
Subject: Transferred Slip
Attachment: TTSLIP122020.rar (contains "TTSLIP122020.exe")

AgentTesla SMTP exfil server:
smtp.ionos.de:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
290
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.9003.28804.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4060f04322ea7b24feefa7541c0e8873791ffa0955af90a2dd8b8a6808c8bb6d/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 08:49:06 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ibqpaqzc5j5sj7xpu5kbyduion4r76qjkwxzbiw5rofgqcgixnwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4060f04322ea7b24feefa7541c0e8873791ffa0955af90a2dd8b8a6808c8bb6d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 4060f04322ea7b24feefa7541c0e8873791ffa0955af90a2dd8b8a6808c8bb6d

(this sample)

AgentTesla

Executable exe d8bc8c8cb41e1541453fbf2f6cef2f6db65e6173a2d3c41a995d789314986d96

  
Dropping
MD5 3e14a13b22b1c8bb29ac4ba736b8f39e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d8bc8c8cb41e1541453fbf2f6cef2f6db65e6173a2d3c41a995d789314986d96

Comments