MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 870e8f1969f0bfc68f88ea06a45b087a8ec73e1cb6c650a0934578b24a40bfba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 870e8f1969f0bfc68f88ea06a45b087a8ec73e1cb6c650a0934578b24a40bfba
SHA3-384 hash: 614bfcb2b1922bd64ea5f7fe8b843423ff619034c2fe4034239133d082dfe57f7e2906c9f02d3c0a247e34e15fe906aa
SHA1 hash: 0cb7cbc0f03b1a759c1367f562ae3509b48062f8
MD5 hash: 0a62e153be3274d00705da9af9e73298
humanhash: zulu-iowa-venus-beer
File name:payment notification.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:291'796 bytes
First seen:2021-04-06 08:13:52 UTC
Last seen:2021-04-06 11:14:15 UTC
File type: gz
MIME type:application/gzip
ssdeep 6144:dWAxLFQ5T7z+58DXNv8DBg9UminvNQ7OobIHNgLKjXi8:Le5Tn+58hkK6mq+OxHNgLF8
TLSH 04542366AE9A5784136D2006F12E3A586D90B83061CDF3F67B0B57EE2BAC9FDD412305
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slot0.wemoveultd-ss.com
Sending IP: 194.31.96.133
From: Mohammed <moh@consultragroup.com>
Subject: Re: Invoice
Attachment: payment notification.gz (contains "payment notification.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46031737.8548.27660.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/870e8f1969f0bfc68f88ea06a45b087a8ec73e1cb6c650a0934578b24a40bfba/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 08:14:10 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q4hi6glj6c74nd4i5idkiwyipkhmopq4w3dfbietiv4lessax65a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/870e8f1969f0bfc68f88ea06a45b087a8ec73e1cb6c650a0934578b24a40bfba

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 870e8f1969f0bfc68f88ea06a45b087a8ec73e1cb6c650a0934578b24a40bfba

(this sample)

AgentTesla

Executable exe 105f2576744d531eaa8515b275542809e6385397b95e735e54c7dad418c4e0c1

  
Dropping
MD5 3c86a6495cd781d45c1545152d73bd3f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 105f2576744d531eaa8515b275542809e6385397b95e735e54c7dad418c4e0c1

Comments