MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 600b20a6bdd3db29a3416fecbe16e5d83906084e500a3098508ac467ea074bd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 600b20a6bdd3db29a3416fecbe16e5d83906084e500a3098508ac467ea074bd1
SHA3-384 hash: 2fa871810216210c2a875be5c07e0449f5ed7cafde57795ad4c4b7726b6b783d0c7da6387db646d0b2a62eeae9576279
SHA1 hash: cdbe826f1489605b4c8daa951946f8b39bc39c8f
MD5 hash: 7c033a98644a1fda85040feb6d316a72
humanhash: kilo-white-minnesota-autumn
File name:BL y documentos de envío.PDF_________________________________.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:364'523 bytes
First seen:2020-07-22 10:06:44 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:91+Y401qRxyx1ksF1qU9a9ZDL0R9v+wkr6ppN+ZdV8bLMRTlrCsE+QV05ZNApI61:9c61SybdTgbmv+hdZ4bLMRIsEcC51
TLSH B57423BA98B6B7398B941AF006BBA0E07CEE5359C94B8E793F14078170A5DDF4353447
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dns28.sysop28.com
Sending IP: 72.52.252.58
From: Gerente de carga de DHL <calidad@serviseguros.com.ec>
Subject: RE: Su notificación de envío de DHL
Attachment: BL y documentos de envío.PDF_________________________________.gz (contains "BL y documentos de envío.PDF_________________________________.bat")

AgentTesla SMTP exfil server:
mail.arigmed.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/600b20a6bdd3db29a3416fecbe16e5d83906084e500a3098508ac467ea074bd1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 10:08:06 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mafsbjv52pnsti2bn7wl4fxf3a4qmccokafdbgcqrlcgp2qhjpiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legal
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/600b20a6bdd3db29a3416fecbe16e5d83906084e500a3098508ac467ea074bd1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 600b20a6bdd3db29a3416fecbe16e5d83906084e500a3098508ac467ea074bd1

(this sample)

AgentTesla

Executable exe 2c187355df4f12de133694fdf1d552ed894b937d9028fe1dc9e6b35af933578b

  
Dropping
MD5 aaa351becc163c798107407ad656bf64
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2c187355df4f12de133694fdf1d552ed894b937d9028fe1dc9e6b35af933578b

Comments