MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c7cbc418956ef5ea2a8f62d368d124f28af729867b69cbd8addba3b25ab9b70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c7cbc418956ef5ea2a8f62d368d124f28af729867b69cbd8addba3b25ab9b70
SHA3-384 hash: f614fdc6cbc6e4f9abc92a46db03665ec34918d93c88a4753404868e89e6538f9b8184443e33934106e5bb185cdf6a03
SHA1 hash: a2d05d5064251e67cb9ab8b2c61d936988812bc1
MD5 hash: 24fd9e6914d1a237dc8a93bc9d8de0fb
humanhash: whiskey-earth-nitrogen-princess
File name:Price Offer2.pdf.uu
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'090'889 bytes
First seen:2020-05-28 06:31:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:mP/kBc+FLb+elqCAfTc5MTv8i/iRGFr6mignFYintRqTs+sHVh:8/kBc+Fuel1Abc5MT0RGFr6+nFrtRB+M
TLSH 553533DA73A238D7F066990F782F67A1BCC88DC76C336EA7E250B6761289754D08C471
Reporter abuse_ch
Tags:AgentTesla uu


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail04.filter06.mta.whmpanels.com
Sending IP: 188.209.214.51
From: Murat.Ozturk@cayan.com.tr
Subject: CAYAN // Price Offer - 28.05.2020
Attachment: Price Offer2.pdf.uu (contains "Price Offer2.pdf.exe")

AgentTesla SMTP exfil server:
mail.brymormaks.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 06:36:34 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 1c7cbc418956ef5ea2a8f62d368d124f28af729867b69cbd8addba3b25ab9b70

(this sample)

AgentTesla

Executable exe a3431de739fdc4078088bac28c881d6ae53135a82f6ffaced81807c605d4e437

  
Dropping
MD5 322098f5b3d28f6555d2354919f1d323
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a3431de739fdc4078088bac28c881d6ae53135a82f6ffaced81807c605d4e437

Comments