MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b23a203a4c236ac82e31d9de465956561e07afe1c4541f0cdf10ced5352dbf4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b23a203a4c236ac82e31d9de465956561e07afe1c4541f0cdf10ced5352dbf4
SHA3-384 hash: cd90fb3745b22fed326cc6ae95963b654ec5205fce666d015d762089fdbe36a97236d1193536b0167f55a0a37d1f3819
SHA1 hash: 69e3358e13ba2f4490e95a7d8d72283013a012f2
MD5 hash: 2ae4d5b8353da8fc826a780a0c6e9c44
humanhash: angel-mockingbird-victor-whiskey
File name:SKCM_PO52014216_2020062246736543,pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:368'412 bytes
First seen:2020-06-22 07:34:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:SQqppqVDLZPnJoJMJAMLQN8nN8ri6OCxybQriCK/6ozviyXVxadFjXYj8LHd9aKD:SQsyfJ+MeMLQCnN8m6OCxxih/3VxadFl
TLSH FE742309A818C401F17A7FBD64BB5404F8601E057C7ED8BB66C96492B8212FD85EEEE7
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: joyspeed.com
Sending IP: 156.96.45.138
From: "Peina Zhang" <peina.zhang@joyspeed.com >
Subject: Order confirmation 52014216
Attachment: SKCM_PO52014216_2020062246736543,pdf.z (contains "SKCM_PO52014216_2020062246736543,pdf.exe")

AgentTesla SMTP exfil server:
mail.bioaktif.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis63715DF92E44.17574.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b23a203a4c236ac82e31d9de465956561e07afe1c4541f0cdf10ced5352dbf4/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 07:35:51 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pmr2ea5eyi3kzaxddwo6izmvmvq6a6x6drcud4gn6ego2u2s3p2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7b23a203a4c236ac82e31d9de465956561e07afe1c4541f0cdf10ced5352dbf4

(this sample)

AgentTesla

Executable exe 8e4a90fb7bf99386930c9ccb7752e235b38f10b49211b496ab30dffaaf16f042

  
Dropping
MD5 dbabee5a9e7a7641a2490fad6d80c96b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8e4a90fb7bf99386930c9ccb7752e235b38f10b49211b496ab30dffaaf16f042

Comments