MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db4e8156644672162bc1781db0c86b5f555ae11733f8c70765a619286852f3de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db4e8156644672162bc1781db0c86b5f555ae11733f8c70765a619286852f3de
SHA3-384 hash: 4beef98cbdd636ed89e294389c88cc8465e91e7e80ca541d7e587cb7254d84f71504f296bf54511faf864c0294a71e5e
SHA1 hash: 768beebc5163cf24c41a86608931932577df5471
MD5 hash: ad7380c994e93128fc0145411b91c0ca
humanhash: alpha-seventeen-west-uncle
File name:PO copy.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:415'582 bytes
First seen:2020-06-23 05:31:03 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:itZ0vfybnLQ8R89bmzis0cHkUz3QOsRvSmisP:itZGknLQ8RQm+lIF3JsG2
TLSH F994234FBB2D9BEA950264E64AF43EADF850AC523385AFDDF2E594B004191530C6FE13
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: yandex.ru
Sending IP: 95.211.208.58
From: Export Department <ac.general@yandex.ru>
Subject: FWD:答复:Urgent Request for Invoice
Attachment: PO copy.pdf.z (contains "PO copy.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/db4e8156644672162bc1781db0c86b5f555ae11733f8c70765a619286852f3de/
Threat name:
Win32.Hacktool.CeeInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-23 05:33:04 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3nhicvteizzbmk6bpao3bsdll5kvvyixgp4mob3fuymsq2cs6ppa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z db4e8156644672162bc1781db0c86b5f555ae11733f8c70765a619286852f3de

(this sample)

AgentTesla

Executable exe bd41417bfd1a5a3a4728eda91829dfcf381d84029a929a5fc23a0c03397042f0

  
Dropping
MD5 1d3b57ddb13786bfc77caf6db5baf2c7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd41417bfd1a5a3a4728eda91829dfcf381d84029a929a5fc23a0c03397042f0

Comments