MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b205abcce93484020d8e7452cfd8cd38f74b91d99ff8a80aae07c1ac67d0423. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b205abcce93484020d8e7452cfd8cd38f74b91d99ff8a80aae07c1ac67d0423
SHA3-384 hash: a6eac3c64edc063c7bdb1fc1a17dc60cbaf406de9892976864c7cfc02184f56336d5e120183bbff8817d87107a53db18
SHA1 hash: 0a0b6836ac34feea53cb839db038445f5d8a17d0
MD5 hash: 73eb95fef89ecc0a4fbdda4634403a60
humanhash: uranus-steak-diet-pizza
File name:Invoice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:381'138 bytes
First seen:2020-07-12 08:16:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:L8lTxuHs9veueE9i0F6T5pr7AESQ/rkcV2FLUvUOWtLw3X6nT9j34YZg+bKsgamF:LqLvDk3r78Q/h2FL6LAT9jIY1bo2z8
TLSH CF8423F34C8AABE7835F7D3CEAE5C81B7D84C493A987946111EF9A49779733A6034240
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.allfrice.com
Sending IP: 45.95.169.51
From: Sales Admin<nnadaiyazhagan@tesla.com>
Subject: PURCHASE ORDER
Attachment: Invoice.zip (contains "Invoice.exe")

AgentTesla FTP exfil server:
asnbanknl.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25244.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b205abcce93484020d8e7452cfd8cd38f74b91d99ff8a80aae07c1ac67d0423/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-07-12 08:17:06 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pmqfvpgosneeaigy45csz7mm2ohxjoi5th7yvafk4b6bvrt5aqrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7b205abcce93484020d8e7452cfd8cd38f74b91d99ff8a80aae07c1ac67d0423

(this sample)

AgentTesla

Executable exe f6fc22ec88e5653d35064b62baba0b24d9a66391412f21488053e6df37b87c98

  
Dropping
MD5 da4e69129661f06319d09a815b0b98d7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f6fc22ec88e5653d35064b62baba0b24d9a66391412f21488053e6df37b87c98

Comments