MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c191c64d52cb172cfa40682167ad088102296b3fb75732abb038d63b28e671c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c191c64d52cb172cfa40682167ad088102296b3fb75732abb038d63b28e671c7
SHA3-384 hash: a55affde6f379ba1a1b3b0cfb880c6c2eca4c7aa82bf5170281e204ca59430e0c903bf6a12f07a207dd2cfe93d30d3fb
SHA1 hash: fe3440d345e64835b8e9936d1aa17518594aa682
MD5 hash: 28d88785c678eddf15bb0a345bd130c0
humanhash: lima-pizza-apart-butter
File name:Tracking No_SINI0068206497.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:250'434 bytes
First seen:2020-06-29 06:17:45 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:JQ/8KcLqZPvA7MLykHaaCfbtqEDahMhnA3EhstO4LJf+0pEw4Mk:JWsLCkMfCDCGhVQOLIZPk
TLSH 8334238FAD45004E219AFFC903D98168E31BCCEBF95F9F27489066807067B62F8694C7
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail0.605.xianwongleepxc.casa
Sending IP: 167.71.237.232
From: DHL EXPRESS <noreply@605.xianwongleepxc.casa>
Reply-To: muthu.spmuthiah@gmail.com
Subject: DHL PO1001910 Sample Arrive : Tracking No_SINI0068206497
Attachment: Tracking No_SINI0068206497.gz (contains "Tracking No_SINI0068206497.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43405742.3959.32509.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c191c64d52cb172cfa40682167ad088102296b3fb75732abb038d63b28e671c7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 06:19:05 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ygi4mtkszmlsz6sanaqwpliiqebcs2z7w5ltfk5qhdldwkhgohdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz c191c64d52cb172cfa40682167ad088102296b3fb75732abb038d63b28e671c7

(this sample)

AgentTesla

Executable exe 60a29266c95ea0804f9ac2ac669d0999bd484bdb94b557a6068479a08bee287f

  
Dropping
MD5 b7e02b8d8c0afe455b470b6fce421357
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 60a29266c95ea0804f9ac2ac669d0999bd484bdb94b557a6068479a08bee287f

Comments