MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8249b38d708e1e0180e959a8df0227416a2586e6a36a9d242c848205348cea2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8249b38d708e1e0180e959a8df0227416a2586e6a36a9d242c848205348cea2
SHA3-384 hash: fb71cfe00f6841dcac449e961bb85993c878215a41a7299b3a0daa9c5f58b005cc8f761ac619ea96d98f922608553661
SHA1 hash: 759bb0c5b6f0fc5420fdf7cf629d41bd16d5e3aa
MD5 hash: bf8e8f5c44345f9f6a7b56ba2f35bda2
humanhash: monkey-delta-orange-muppet
File name:Payment Advice.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:704'216 bytes
First seen:2021-03-04 07:19:15 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:K0JWjLL+sdGD5nnrszJ49lohebKD9FnRDpxTCde6ktSyJd841p8K1GEstTtG:9Jud4D1Yi9lowbKDD1pxOM9t1aNtG
TLSH 0CE433B3722ACEC7547B09C5D41E11ED8806199E2E28581F8DF4F16BAF1DE9F80F51A8
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: "Kassem Ahmed <purchase@darwish-tdg.qa>" (likely spoofed)
Received: "from wp.sarwatech.com (unknown [202.51.74.41]) "
Date: "Thu, 04 Mar 2021 08:00:20 +0545"
Subject: "Payment Advice"
Attachment: "Payment Advice.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.21938.6469.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c8249b38d708e1e0180e959a8df0227416a2586e6a36a9d242c848205348cea2/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-03-04 07:20:16 UTC
File Type:
Binary (Archive)
Extracted files:
48
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zasjwogxbdq6agaoswni34bcoqlkewdoni3ktusczbecau2iz2ra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/c8249b38d708e1e0180e959a8df0227416a2586e6a36a9d242c848205348cea2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz c8249b38d708e1e0180e959a8df0227416a2586e6a36a9d242c848205348cea2

(this sample)

AgentTesla

Executable exe 29d756d4f6026e22da3178fff23fb162855ed79dbf07f51d2af6a146d0326de9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 29d756d4f6026e22da3178fff23fb162855ed79dbf07f51d2af6a146d0326de9
  
Dropping
AgentTesla

Comments