MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60023d83cb9fd52acc5da2f4e7b4f73e455909e6271a078061491e4eb8ea9daa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60023d83cb9fd52acc5da2f4e7b4f73e455909e6271a078061491e4eb8ea9daa
SHA3-384 hash: 7236618432fea50176f18569980a6f5f83fc12d2d5e2f5dcfc7e4a857e60aaf9fffaa402cea75f2517971bc0fd13563c
SHA1 hash: 68522f66996cddd718cbf112e139c40cf75fe6cb
MD5 hash: 47ab4109348e7c4ab80b81e5cf5d5900
humanhash: lemon-high-floor-butter
File name:TFTU6843783 - 32.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:911'466 bytes
First seen:2020-12-26 06:22:14 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:/NvauuZXpkTL9h5VdsBUHc3rGufoAOrkl3yH:/V0pGZhHWBUHc7mAOrfH
TLSH FC153390B450E0C019E83AC9A2036B7A7E6F0795685EBF17614FA1075F3D7C0B15AEBE
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Shed3 lcl" <implcl3@gateway-distriparks.com>" (likely spoofed)
Received: "from gateway-distriparks.com (unknown [103.99.1.174]) "
Date: "25 Dec 2020 02:13:22 -0800"
Subject: "Damage Cargo ( TFTU6843783 - 32 )"
Attachment: "TFTU6843783 - 32.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
421
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60023d83cb9fd52acc5da2f4e7b4f73e455909e6271a078061491e4eb8ea9daa/
Threat name:
Win32.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-12-25 08:03:39 UTC
File Type:
Binary (Archive)
Extracted files:
44
AV detection:
19 of 47 (40.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mabd3a6lt7ksvtc5ul2opnhxhzcvscpge4napadbjepe5ohktwva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/60023d83cb9fd52acc5da2f4e7b4f73e455909e6271a078061491e4eb8ea9daa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 60023d83cb9fd52acc5da2f4e7b4f73e455909e6271a078061491e4eb8ea9daa

(this sample)

AgentTesla

Executable exe cc88bd3a08611e1f813dc1a9885ca7cee62e0c6fba330d9f8dad89f01e319b2b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc88bd3a08611e1f813dc1a9885ca7cee62e0c6fba330d9f8dad89f01e319b2b
  
Dropping
AgentTesla

Comments