MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7803e7293c1fd6c51d5c708045a8efc6fc0e89adbe3676ad8a65306265cc684e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7803e7293c1fd6c51d5c708045a8efc6fc0e89adbe3676ad8a65306265cc684e
SHA3-384 hash: fd3d0e43154af8264efa4fe7683c1e3b36a4e5468c9c820e686e8dd18b14455c9d9c9d6b67f3ee0f4e120bd4cd5ac8e1
SHA1 hash: 07ea49072bf468cee7d69e3b701d7fc5f38f47ce
MD5 hash: 68e6de367ef039197614d2245ce43373
humanhash: maryland-lake-maryland-delta
File name:CCE05082020_003 Dunamis Order 20200512 ,pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:427'324 bytes
First seen:2020-05-13 06:54:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:aM00NkByg1RLktEUIqwsWpvvsIIZq5ixsSnEXz8:yyakmnqwsc3IZq5snt
TLSH 629433137A49B326E2B78D3787D94C8E1B1BA8FE1309D5B8480E59D9642CB91CF44FA4
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gmail.com
Sending IP: 103.133.111.162
From: Priscilla Paradiso <qddbcindy@gmail.com>
Subject: Urgent Inquiry From Dunamis Industrial Ltd
Attachment: CCE05082020_003 Dunamis Order 20200512 ,pdf.zip (contains "CCE05082020_003 Dunamis Order 20200512 ,pdf.exe")

AgentTesla SMTP exfil server:
mail.ilclaw.com.ph:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 07:36:53 UTC
File Type:
Binary (Archive)
Extracted files:
22
AV detection:
20 of 31 (64.52%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pab6okj4d7lmkhk4ocaelkhpy36a5cnnxy3hnlmkmuygezomnbha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7803e7293c1fd6c51d5c708045a8efc6fc0e89adbe3676ad8a65306265cc684e

(this sample)

AgentTesla

Executable exe 0549548342761f8d58baa10ff57ba4ba4aad17800c2d5155fb2c29fed8da95b9

  
Dropping
MD5 25d51d97162f97af501b5bee713a9d8f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0549548342761f8d58baa10ff57ba4ba4aad17800c2d5155fb2c29fed8da95b9

Comments