MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8339aaf949af73763c5e6a70a93671acb34144ada73118e2c9b12df9e39fe517. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8339aaf949af73763c5e6a70a93671acb34144ada73118e2c9b12df9e39fe517
SHA3-384 hash: 44894980d374e03a1de40ef35a8ebd613772e2404435ca37bc89dd8af3e7686179e74fa41c53de26978d8943efedc9c9
SHA1 hash: 15793251131f86ca58b8751b83dc3431c2de2251
MD5 hash: 5f1eff96411cc6ea533d41927e6e2b00
humanhash: artist-edward-lemon-carpet
File name:QUOTE 2020.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:789'863 bytes
First seen:2020-09-14 08:58:02 UTC
Last seen:2020-09-14 11:06:18 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:PfsE5PDybyrnJzutvjvlrvsJLy9GBMFA2C+9tqmszQdwv5AnUIt7zLNnMMmvb:PksKLtEJ+94Gmmde5AXtn5MH
TLSH 39F42307865C0FC81938BB4B06625CBF12E1427B403F695F65A7E9D1C1D8EBF86681ED
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: =?UTF-8?B?Um9iZXJ0byBNYXJ0w61uZXo=?= <sales@tyen-axle.com>
Received: from tyen-axle.com (unknown [45.137.22.76])
Date: 14 Sep 2020 04:02:04 -0700
Subject: *URGENT SUPPLY* QUOTE 2020
Attachment: QUOTE 2020.pdf.gz

Intelligence

File Origin
# of uploads :
5
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8339aaf949af73763c5e6a70a93671acb34144ada73118e2c9b12df9e39fe517/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-14 04:17:16 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qm42v6kjv5zxmpc6njyksntrvszucrfnu4yrrywjwew7ty474ulq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8339aaf949af73763c5e6a70a93671acb34144ada73118e2c9b12df9e39fe517

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 8339aaf949af73763c5e6a70a93671acb34144ada73118e2c9b12df9e39fe517

(this sample)

AgentTesla

Executable exe 319394e63925320791b1cff1062f5e012adffcf93dc7286a9fd5eedfa42ddc0e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 319394e63925320791b1cff1062f5e012adffcf93dc7286a9fd5eedfa42ddc0e
  
Dropping
AgentTesla

Comments