MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21a59260aef41c53dc24f415f3b2ac0ff39f19089702e5bf257129537a4536ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21a59260aef41c53dc24f415f3b2ac0ff39f19089702e5bf257129537a4536ab
SHA3-384 hash: 23e3e9f0e28361e4697056b00506e0e0b957d231e45b33ad9ffc4652566dccc59072bf574af442c45e99d11921274801
SHA1 hash: e7607140c7db0333a9ff196e1fcaadd1ee1ad48c
MD5 hash: fe944097611b39711ff3181d11f37aca
humanhash: india-xray-potato-mirror
File name:20200519215101874.pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:463'587 bytes
First seen:2020-05-20 08:52:29 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:n40DzUkBiElvzxVJr26AkqJQgr47jl8UJfrZ1eC5dWS:n4/ElvtLrITryvBrZ1D5dWS
TLSH 20A423915E37AF7405219AE8F96D80B8627A440422E3DFF4F50EE05A8153B9F4C2FDA9
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.websitetestingtoday.best
Sending IP: 79.124.8.124
From: CAO <cao@vinastardiamonds.com>
Subject: Asking for goods quotation - [REDACTED_DOMAIN] supplier
Attachment: 20200519215101874.pdf.7z (contains "20200519215101874.pdf.exe")

AgentTesla SMTP exfil server:
smtp.pbrend.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 09:40:54 UTC
File Type:
Binary (Archive)
Extracted files:
22
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=egszeyfo6qofhxbe6qk7hmvmb7zz6giis4bolpzfoeuvg6sfg2vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 21a59260aef41c53dc24f415f3b2ac0ff39f19089702e5bf257129537a4536ab

(this sample)

AgentTesla

Executable exe 6021bc47c304637516833c05a64218b0e77a7075e7e4d19579cad97493db42c1

  
Dropping
MD5 8eb6a046cccc097a63dee57aadd1a0c8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6021bc47c304637516833c05a64218b0e77a7075e7e4d19579cad97493db42c1

Comments