MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c951737c6cff4306a0a8ebbd55f5106f3a6da5909b9782cd78bf52146c74b99a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c951737c6cff4306a0a8ebbd55f5106f3a6da5909b9782cd78bf52146c74b99a
SHA3-384 hash: 62b272381d9fd2db7ea86b762dd53e8e8d75bb279f3c09686cb93a3d51308f8ef216243e3c972cf7d23bf75dc9bf6e92
SHA1 hash: 61db35744a3e15967e3fd0d5ecdc9615d6943997
MD5 hash: ab34b36bd27048bf880a9c8afa43681a
humanhash: failed-maine-carolina-robert
File name:Supplier-Face Mask Forehead Thermometer.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:426'404 bytes
First seen:2020-05-12 06:32:41 UTC
Last seen:2020-05-12 09:33:27 UTC
File type: gz
MIME type:application/x-rar
ssdeep 6144:XcMrZdGH9NeO5k74J6kuyKF6hRIB59+i1E7r3Bt+Cho5kQZYrsyYh+/kz0NUSezB:XcMG9ReshQF6Q59EXhx0oriGkomgM
TLSH B79423AAFEE927C40787F941D6582233236ED53621136D25CA971F94B03C20BB5BF91B
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: spb-bearing.com
Sending IP: 156.96.47.65
From: Smile Lee <sales@spb-bearing.com>
Subject: Supplier-Face Mask/ Forehead Thermometer
Attachment: Supplier-Face Mask Forehead Thermometer.pdf.gz (contains "Supplier-Face Mask Forehead Thermometer.pdf.exe")

AgentTesla SMTP exfil server:
mail.oilexindia.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200513-0922.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 02:55:11 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zfixg7dm75bqnifi5o6vl5iqn45g3jmqtolyftlyx5jbi3duxgna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz c951737c6cff4306a0a8ebbd55f5106f3a6da5909b9782cd78bf52146c74b99a

(this sample)

AgentTesla

Executable exe 3d7b3c0c4c19a6c9de8e9884b5d3f55afd6d90ed10255d27f51fc10f1f26c66f

  
Dropping
MD5 e4362764c98f8fe037e495f1b17c9ed2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3d7b3c0c4c19a6c9de8e9884b5d3f55afd6d90ed10255d27f51fc10f1f26c66f

Comments