MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7afa4b711714c420df3cf3f66e44ba9d0c11124f6e2b22b68ed3d6a0a03e4488. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7afa4b711714c420df3cf3f66e44ba9d0c11124f6e2b22b68ed3d6a0a03e4488
SHA3-384 hash: 4cde0ff134237fbce669c621bf1ec2b62a5617e9659cdbf4de8d9e604e3605a0c23aa84e0f17a0bbecada0c0093cd549
SHA1 hash: 75e7b4bca9cbfaf7e571414f17cc235cbcc115df
MD5 hash: d5b98fbaeddbca0e467aa4e771d55a44
humanhash: high-venus-monkey-lima
File name:AWB5421457894.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:289'009 bytes
First seen:2020-07-20 07:58:32 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:L6erSqPo/Q5BqN8a9odGZgeUlNGW7p3BU6QgmB6rzmlu:FFPoQu8aWA5mpu6pzmlu
TLSH 1654239B2E5825A2B409C0362B44E510F114ECD76B3767D9B872E6444BB1C19FFBFC8A
Reporter abuse_ch
Tags:7z AgentTesla DHL


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dhl.com
Sending IP: 103.99.1.141
From: DHL EXPRESS <noreply@dhl.com>
Subject: RE: DHL Shipment Notice of Arrival: AWB 5421457894
Attachment: AWB5421457894.7z (contains "AWB#5421457894.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7afa4b711714c420df3cf3f66e44ba9d0c11124f6e2b22b68ed3d6a0a03e4488/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 08:00:11 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pl5ew4ixctccbxz46p3g4rf2tugbcespnyvsfnuo2plkbib6isea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/7afa4b711714c420df3cf3f66e44ba9d0c11124f6e2b22b68ed3d6a0a03e4488

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 7afa4b711714c420df3cf3f66e44ba9d0c11124f6e2b22b68ed3d6a0a03e4488

(this sample)

AgentTesla

Executable exe 2e50f8b1d260cd858d97aff46f8c157b940d6db17673ec99f9304ac963f32473

  
Dropping
MD5 9e50434dd1d10773a9d2acc0ca50284e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2e50f8b1d260cd858d97aff46f8c157b940d6db17673ec99f9304ac963f32473

Comments