MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb27ec3e5bb43ad1490e1f333b190a487b1bdf02c6228ffe8a3f6d1a39658f40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb27ec3e5bb43ad1490e1f333b190a487b1bdf02c6228ffe8a3f6d1a39658f40
SHA3-384 hash: ceaf61d173953a729d5088a97dd0c37f7c3c1c74e927142b0be979304372ec66c3d70532b14ab8b840dfb550bd8dca84
SHA1 hash: 9b5b5454f1a40a6825fffdd2928508376ad4753e
MD5 hash: ee579381a28410482f46f34b28d87ba4
humanhash: artist-asparagus-cola-fruit
File name:Scan_23748991000.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:620'301 bytes
First seen:2021-01-06 08:02:06 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:+zuknAzON51E8m/ru8au7OmBReOTM/tF/gd1apNoxwywKhWNvTWIH91:+zHAzONDbgdneu24fapNoTwK0VHP
TLSH 8DD43367F225077BEC4C030C9DFF818D47651EF6E3504A9E6263A502BA22A67EF51398
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail11.digistar.vn
Sending IP: 103.254.14.161
From: Jennny Stark. <thuydt@tdh-hitech.com.vn>
Subject: RE: Packing list and Draft B/L
Attachment: Scan_23748991000.gz (contains "Scan_23748991000.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb27ec3e5bb43ad1490e1f333b190a487b1bdf02c6228ffe8a3f6d1a39658f40/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-06 08:02:09 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7mt6yps3wq5ncsiod4ztwgikjb5rxxycyyri77ukh5wruolfr5aa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fb27ec3e5bb43ad1490e1f333b190a487b1bdf02c6228ffe8a3f6d1a39658f40

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz fb27ec3e5bb43ad1490e1f333b190a487b1bdf02c6228ffe8a3f6d1a39658f40

(this sample)

AgentTesla

Executable exe a2267c6724ab4e4a965938b0ee2c926ffa2df8b81ed582c1424d224f35eec2e0

  
Dropping
MD5 ff65814322f31577345615a1f470f29f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a2267c6724ab4e4a965938b0ee2c926ffa2df8b81ed582c1424d224f35eec2e0

Comments