MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07da65861da3856029dfd17c4e671b3f004fcb7cf9bc638113da0f2d795d3adf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07da65861da3856029dfd17c4e671b3f004fcb7cf9bc638113da0f2d795d3adf
SHA3-384 hash: 11e3700d77ef3f56e8d213a6b4e231175ff4357f76ceb1ba178f84a486e2b1c5b70a84d7809c6ecb463dc8902f3edbb8
SHA1 hash: 552b3ff3a7fb7ca3880882af83f13a77972f2b6f
MD5 hash: 5327454c14756256abfd50c80ce7ac04
humanhash: ink-green-hotel-colorado
File name:ORDER LISTED .UUE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:414'830 bytes
First seen:2020-08-08 08:15:07 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 6144:7pGlSCkVhFeKsLQDkK8bBFfe5hsigJpIMY8uTLnBNVKzK33BUrVadkWTaB6+cPzR:MzMbVaQDkHm/6JpIasLzgW33BnaB69
TLSH DE9423C20BF9FBECE1178214D141AD6BB4240FC5BBAC6CA4F5235D61E82432DB2979D5
Reporter abuse_ch
Tags:AgentTesla uue


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx1.supremebox.com
Sending IP: 198.23.53.175
From: thansi arshad <thansi.ap@shaklangroup.com>
Subject: Request for quotation
Attachment: ORDER LISTED .UUE (contains "j5C4kIKEckYxsyY.exe")

AgentTesla SMTP exfil server:
smtp.mail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07da65861da3856029dfd17c4e671b3f004fcb7cf9bc638113da0f2d795d3adf/
Threat name:
Win32.Trojan.Bluteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-08 01:35:15 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a7nglbq5uocwako72f6e4zy3h4ae7s347g6ghait3ihs26k5hlpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/07da65861da3856029dfd17c4e671b3f004fcb7cf9bc638113da0f2d795d3adf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

uue 07da65861da3856029dfd17c4e671b3f004fcb7cf9bc638113da0f2d795d3adf

(this sample)

AgentTesla

Executable exe abfab2713c15881c249a3779e3c51a32b173c1e899b4a4923399d865fa68ec03

  
Dropping
MD5 d47336bd0ebdb274f5eaa7821c6f808b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 abfab2713c15881c249a3779e3c51a32b173c1e899b4a4923399d865fa68ec03

Comments