MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4d78d6a2f382d66f0d5f5d100b96682eb7058a3ab163d50ae178ff43330e51e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4d78d6a2f382d66f0d5f5d100b96682eb7058a3ab163d50ae178ff43330e51e0
SHA3-384 hash: 7cd1e7a178f1a113622e21409dd25dd4515579b698e18f7c1b687547d4330c816b38a638f4ef43e2296aecf6e0356e00
SHA1 hash: ff55d23a18729c53b65098d84577bf9700bef44a
MD5 hash: 1939ac41b2caba94e7b0cd39a1ca5937
humanhash: michigan-shade-avocado-oven
File name:Urgent Purchase Order QT-PO10-00510-Rev01_PDF.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:826'443 bytes
First seen:2020-05-14 06:38:45 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 24576:QeP+iF3ghiII7jYI6Eznm1qD2OfrfztDeLXynU52gZ:QSF3ghFI7/62xD2OTfxDeL152gZ
TLSH FC052383C7092C83705834B9B1365CACCA83D5937542F2B8593C5467EE9B91CE76D8BB
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.ducki.at
Sending IP: 62.178.116.10
From: Manuel Blau <manuel@ducki.at>
Subject: AW: Re: New Order
Attachment: Urgent Purchase Order QT-PO10-00510-Rev01_PDF.7z (contains "Urgent Purchase Order (QT-PO10-00510-Rev01)_PDF.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 07:36:46 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jv4nnixtqllg6dk7luiaxftif23qlcr2wfr5kcxbpd7ugmyokhqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 4d78d6a2f382d66f0d5f5d100b96682eb7058a3ab163d50ae178ff43330e51e0

(this sample)

AgentTesla

Executable exe 2807548dd82445eeac614506066b893c6cd90c8b02c6374dfa491defc817007a

  
Dropping
MD5 e979974afd7523a5b3f918eecced480e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2807548dd82445eeac614506066b893c6cd90c8b02c6374dfa491defc817007a

Comments