MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40b210e9bf71dcf8547791fe79c99aca6cbc2c932b9b975b64220a56699a1222. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40b210e9bf71dcf8547791fe79c99aca6cbc2c932b9b975b64220a56699a1222
SHA3-384 hash: 9681c17ea79a1cc3e1436d37285c90bdee533096b2dcfb37ed7a71afd6d946f21f59c226d0ce72749c3b63b618d68f0b
SHA1 hash: 94c41e8e3e4d4258648d06b25f0a5f7a6b9288d2
MD5 hash: d6970e2f28b85947a33845d554e434e2
humanhash: triple-paris-beer-tango
File name:GHCL_Outstanding Invoice.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:158'290 bytes
First seen:2020-07-17 16:07:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:XZur2s5rLFOZpNzfxo4QKkXrSXg3aL+wRlnkHH18WN:gxnQZ3pFkZe8HV8e
TLSH E4F312512CF1324843E20D0057A76EA1C08EA92E9D358DD9FF2478BCF899DEB479AD1D
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.example.com
Sending IP: 103.147.184.169
From: ZAFAR SURGICAL INSTRUMENTS <admin@beoxies.ml>
Subject: RE: GHCL - Outstanding Invvoice
Attachment: GHCL_Outstanding Invoice.rar (contains "GHCL_Outstanding Invoice.exe")

AgentTesla SMTP exfil server:
smtp.office365.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27502.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/40b210e9bf71dcf8547791fe79c99aca6cbc2c932b9b975b64220a56699a1222/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-07-17 16:09:04 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iczbb2n7ohopqvdxsh7htsm2zjwlyletfonzow3eeiffm2m2cira._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/40b210e9bf71dcf8547791fe79c99aca6cbc2c932b9b975b64220a56699a1222

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 40b210e9bf71dcf8547791fe79c99aca6cbc2c932b9b975b64220a56699a1222

(this sample)

AgentTesla

Executable exe 86982b1027562eab1b1cf1a8edc4fa165bacc43ae328405e7ec633f44b072796

  
Dropping
MD5 06929a1815528f683b025621af03bdb2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 86982b1027562eab1b1cf1a8edc4fa165bacc43ae328405e7ec633f44b072796

Comments