MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1019f37c84192313397e35f957be1a8871dc9554f6bf47ae16b6079ebdcc5c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1019f37c84192313397e35f957be1a8871dc9554f6bf47ae16b6079ebdcc5c6
SHA3-384 hash: 2c82bfbd4a42d4f1e85aa639ca86409563398ae311eb2f291ec7f29278b41b8c9765e3d8999e292e883d3bee0cae3643
SHA1 hash: d783dc84b240b7ec3d2cefbbc82349388ecca83d
MD5 hash: 4aa8558c901d9bd4ef189e573d5fa764
humanhash: fanta-salami-paris-oregon
File name:GOODS REQUIREMENT_PDF.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:440'972 bytes
First seen:2020-05-27 11:42:01 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:7j9/XgNiwnaVVZBFVUT4CLs94ShgzOtPfAIseDW+h4+s9PFIxRM9lhl8wCg84isU:7jhXgNtnaDZxE4CL18AXm30NdisU
TLSH F39423AED508D326F57334BEDE1D51FC8E2066B75E8E1A828A7CB7270F9548925C0B43
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mailer11-1.incnets.com
Sending IP: 210.6.92.71
From: Sales Manna <sales09@manna.corp.com.hk>
Subject: Manna-corp
Attachment: GOODS REQUIREMENT_PDF.gz (contains "GOODS REQUIREMEN.exe")

AgentTesla SMTP exfil server:
smtp.foximal.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 10:42:08 UTC
File Type:
Binary (Archive)
Extracted files:
275
AV detection:
14 of 30 (46.67%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz c1019f37c84192313397e35f957be1a8871dc9554f6bf47ae16b6079ebdcc5c6

(this sample)

AgentTesla

Executable exe f617d0d418002e4bc75319ae825a09d15de76f5795bfd5b835491134e504d2ac

  
Dropping
MD5 cd234c4609bfc5fc45e3e57fbc980367
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f617d0d418002e4bc75319ae825a09d15de76f5795bfd5b835491134e504d2ac

Comments