MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7924f9c316abfbf6f7093b7400a8a630269736dda2b7bcba11f7e4e1b4fcc6ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7924f9c316abfbf6f7093b7400a8a630269736dda2b7bcba11f7e4e1b4fcc6ab
SHA3-384 hash: 335c894090915b36e34b5fc76354ed46cf2b500cadb104d8961bba5fb09a1901616a4b1847a5f215f658122555fcbdd9
SHA1 hash: 2041bdd44ea1a7ba4b13c3166e488087ae3daca1
MD5 hash: 2c2e24a1e9b832a86c965fa0739a81b7
humanhash: sweet-mobile-floor-single
File name:76756-WONFT4-BTO-889769-F3.GZ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:454'695 bytes
First seen:2020-07-31 06:24:01 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:o05wbrtXT0/VfIWAYEHABWTClOgSAIY81lI:oK4rZeDAYEHjrbdhlI
TLSH 77A423EF4881D9046F0E2E0A9DC91B5B80C72EDE9AB32427573C2720ABF56D453A5D1F
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.sinioraefood.com
Sending IP: 104.168.234.182
From: Facturas Sofical <facturas@sofical.es>
Subject: RE:REQUEST FOR QUOTATION( YGB01-E080686)
Attachment: 76756-WONFT4-BTO-889769-F3.GZ (contains "76756-WONFT4-BTO-889769-F3.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7924f9c316abfbf6f7093b7400a8a630269736dda2b7bcba11f7e4e1b4fcc6ab/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 06:25:07 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pesptqywvp57n5yjhn2abkfggatjonw5uk33zoqr67sodnh4y2vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7924f9c316abfbf6f7093b7400a8a630269736dda2b7bcba11f7e4e1b4fcc6ab

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 7924f9c316abfbf6f7093b7400a8a630269736dda2b7bcba11f7e4e1b4fcc6ab

(this sample)

AgentTesla

Executable exe f638bb071b2875d5a6c3fb4903087ad419331fad2d64f88d9a207f0e39bec984

  
Dropping
MD5 6daae5b0328031444500a871282913f0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f638bb071b2875d5a6c3fb4903087ad419331fad2d64f88d9a207f0e39bec984

Comments