MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07b1d6b489aa9a10269e530c0a1d12b4cdfdc9d3300f5ae97f48ca2c693a156b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07b1d6b489aa9a10269e530c0a1d12b4cdfdc9d3300f5ae97f48ca2c693a156b
SHA3-384 hash: 5171611813f0885e09266147b1d6b99f0f987b4155e1d44d44f74c70cdf929f9da434ea51afab05b268e445097b2073e
SHA1 hash: 50fdfe30c0db9290489760ecfdf28f70dec5f19e
MD5 hash: bf776d10da5223ba245e2cf56ead7af3
humanhash: louisiana-green-oranges-yankee
File name:PO 7405591 7756947 7756740 invoice for 30%Deposit.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:477'304 bytes
First seen:2020-07-07 09:49:40 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Zqf989qPy1Uon2l8QDgzE3XcrnYZW9cyJmq5e91:ZqflPO27uESnhcyJFen
TLSH 05A42338596F43C2C8F23DC331A5D553AD4617C751282E153CBE0BB506F21A6AA2BF9E
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail0.612.wulongdimkim.casa
Sending IP: 134.209.149.143
From: SINCERE INDUSTRIAL CORP. <procurement@sincieremarine.com>
Reply-To: ct20320@gmail.com
Subject: PO 7405591 / 7756947 / 7756740 invoice for 30% Deposit
Attachment: PO 7405591 7756947 7756740 invoice for 30% Deposit.rar (contains "PO 7405591 7756947 7756740 invoice for 30% Deposit.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07b1d6b489aa9a10269e530c0a1d12b4cdfdc9d3300f5ae97f48ca2c693a156b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 09:51:04 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a6y5nnejvknbaju6kmgauhiswtg73sotgahvv2l7jdfcy2j2cvvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 07b1d6b489aa9a10269e530c0a1d12b4cdfdc9d3300f5ae97f48ca2c693a156b

(this sample)

AgentTesla

Executable exe 34fe86d0bfa9b01df1b5032307fcd5db980cb32a12bb6320772b99a0e1d2cff8

  
Dropping
MD5 cc815808c88fea55c492113137272b16
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 34fe86d0bfa9b01df1b5032307fcd5db980cb32a12bb6320772b99a0e1d2cff8

Comments