MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83da9db9c91e737451aad35caf1ce14e0878239f179c7f94a42e3b69950dd3ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 83da9db9c91e737451aad35caf1ce14e0878239f179c7f94a42e3b69950dd3ff
SHA3-384 hash: 1b67c8b9f819a2c14a7c94bae651412b257f75cc5a6024c6f13bcf0338918fe446ef898513183062ab3a13df15a50d1e
SHA1 hash: b29b4d8126adaeeb0ee970cc6ea92197bf9e57ff
MD5 hash: 896c453fcb1127adb00dcd34578ea81b
humanhash: pasta-item-paris-juliet
File name:Scan_Document.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:522'391 bytes
First seen:2020-07-18 07:55:27 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:QBIAf1WrwP4f/7cu+gODxWbhWSfDkvP9XleFOWw+LUT:6qwPHu+zFWbJD0VjAUT
TLSH 17B4237EF7B3379405CEA2F5B41D7C64577F683294A3780AECCA8CA906D414F025A92E
Reporter abuse_ch
Tags:AgentTesla gz HSBC


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: staging.maykenbel.com
Sending IP: 195.12.49.182
From: HSBC Bank <advising.service.45111388.809972.2660902352@mail.hsbcnet.hsbc.com>
Subject: Payment Advice 08/07/2020 - Advice Ref:[GLV924565043] / ACH credits / Customer Ref:[C27-20190911-142533] / Second Party Ref:[512389801785]
Attachment: Scan_Document.gz (contains "Scan_Document.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Smdd-6922230-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.Delf.FareIt.Gen.7.2197.30182.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25902.GZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/83da9db9c91e737451aad35caf1ce14e0878239f179c7f94a42e3b69950dd3ff/
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-07-18 07:57:04 UTC
AV detection:
35 of 48 (72.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qpnj3oojdzzxiunk2nok6hhbjyehqi47c6oh7ffefy5wtfin2p7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/83da9db9c91e737451aad35caf1ce14e0878239f179c7f94a42e3b69950dd3ff

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 83da9db9c91e737451aad35caf1ce14e0878239f179c7f94a42e3b69950dd3ff

(this sample)

AgentTesla

Executable exe 4c6f455851b2d70a8c2ffe6561544081b3c98a2e45bf0faa3c58785faefec386

  
Dropping
MD5 1823826b6ff7a839483eb3fa225fc4a5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4c6f455851b2d70a8c2ffe6561544081b3c98a2e45bf0faa3c58785faefec386

Comments