MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0719bb10e8b805d14da7a1f2702b27c06197e0b04a4f21bff03f128caebe61dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0719bb10e8b805d14da7a1f2702b27c06197e0b04a4f21bff03f128caebe61dd
SHA3-384 hash: 945e29631c9d88e0c3ccdf9168c9390d97afd39a0f8649687ad56f2157e716503231fa0b2e6db1550b70a952a02da035
SHA1 hash: 7284aae0121796df9d7e7aee3ab6e24e87957665
MD5 hash: b51d031e69744c135d9a3f194ff86fe1
humanhash: delaware-angel-eleven-yellow
File name:AD1-2001028L pl.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:544'908 bytes
First seen:2020-08-03 15:06:42 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:Jf3sFcVBYc1UG/lNsw0nojqlbVpY9C1lmvyo0fuZhQcSvA3v6hoTczh:uFcVBh1UG/rjqlb7YAO0fuOhT
TLSH 6BC423A007B2FFCB118FA5938135872A42143728939B6ED1AD8739C36FBB91DB5971D0
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ceaworld.com
Sending IP: 45.137.22.54
From: Michael Han <sales12@ceaworld.com>
Subject: Re: invoice For shipment
Attachment: AD1-2001028L pl.gz (contains "AD1-2001028L pl.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0719bb10e8b805d14da7a1f2702b27c06197e0b04a4f21bff03f128caebe61dd/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 13:52:49 UTC
AV detection:
21 of 47 (44.68%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a4m3wehixac5ctnhuhzhakzhybqzpyfqjjhsdp7qh4jizlv6mhoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0719bb10e8b805d14da7a1f2702b27c06197e0b04a4f21bff03f128caebe61dd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 0719bb10e8b805d14da7a1f2702b27c06197e0b04a4f21bff03f128caebe61dd

(this sample)

AgentTesla

Executable exe f8707020bc0b78ae0fab3bd9794993c4cae406d9f13fcb6098f3321cb6bba515

  
Dropping
MD5 67aa4f1586cc229eaacd62deb31eac8d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f8707020bc0b78ae0fab3bd9794993c4cae406d9f13fcb6098f3321cb6bba515

Comments