MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4feb39fe4507e5400a5a58c7bf894a6b696420a2549edd2b3e02b5659947dc97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4feb39fe4507e5400a5a58c7bf894a6b696420a2549edd2b3e02b5659947dc97
SHA3-384 hash: ab99e5ce929a161b42f86c612d9db1b6da31ad055a25bb90daeb8a92a3fe67e852173ff0b16a0da926f0a9ffadd46703
SHA1 hash: a78f7c7aea152751942dda53a5556354fdda6fc9
MD5 hash: d63c093240901ce5d4096aa0a5d11514
humanhash: mars-table-princess-lima
File name:HS CODE 85414020.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:473'539 bytes
First seen:2020-08-15 06:02:59 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:HM3D5K1dlFOPjAzPS84nhqSnDz8ilMK5/6XzB0rLNMc8tQ6:HWD5YuPjAW84YLilsINv8D
TLSH 54A4238E2460918D1088B7BFEF2A3ABE52C9A578FB9145591C417CCF6DCD1132A4DE3E
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cosfresh.com
Sending IP: 185.222.57.157
From: zhuhong3/Zhu Hong(SH-Aoji) <zhuhong3@cosfresh.com>
Subject: COSU6270494600: 7.30EU 晶科能源 晶科德国（MCREDV20Q107-IN）15X40HQ CIF QINGDAO -PIRAEUS 光科 7016389 COSCO AEU3 货7-25号好 YTQDOE2008004
Attachment: HS CODE 85414020.gz (contains "HS CODE 85414020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4feb39fe4507e5400a5a58c7bf894a6b696420a2549edd2b3e02b5659947dc97/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-15 06:04:10 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j7vtt7sfa7suacs2ldd37ckknnuwiifckspn2kz6ak2wlgkh3slq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4feb39fe4507e5400a5a58c7bf894a6b696420a2549edd2b3e02b5659947dc97

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 4feb39fe4507e5400a5a58c7bf894a6b696420a2549edd2b3e02b5659947dc97

(this sample)

AgentTesla

Executable exe 56cb69331a49e5a12f173cd58e68a1ded84247588e0c33dc0571d32caec6a111

  
Dropping
MD5 be764e488a6e7096664047f892cfdd82
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 56cb69331a49e5a12f173cd58e68a1ded84247588e0c33dc0571d32caec6a111

Comments