MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c440920373dea4cc7a497fef5838cb1da7c2d9f907fb419adba94696db709e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c440920373dea4cc7a497fef5838cb1da7c2d9f907fb419adba94696db709e0
SHA3-384 hash: 1c77f664d0178b92e7fd181aba20f5d7fb1dde3fcf2dc012c1a5a6aaf8c2c721fb625847bc3ec2f7172a3b714460cef4
SHA1 hash: 8c2aa19b4e0257639b482b8c3618e0bb4166b19f
MD5 hash: 424080b322b1b08ab977502a0b8eb4d8
humanhash: rugby-failed-green-tango
File name:PO Copy.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:408'445 bytes
First seen:2020-05-10 14:23:39 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:DkC60/rZiWPt7GDqc9aIseEIaIoyDeCHgjpg:DXzzZiWPtEt9aIVaIoMG2
TLSH FE942388F8A7279309E5F2814C943BDF1F7CC969845251E69CE0A3A823BFD96736113C
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: alkuhaimi.com
Sending IP: 95.211.208.58
From: Accounts Department <rud-division@alkuhaimi.com>
Subject: New PO
Attachment: PO Copy.pdf.z (contains "PO Copy.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-10 14:35:52 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=prcasibxhxvezr5es77pla4mwhnhylm7sb73ignnxkkgs3nxbhqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 7c440920373dea4cc7a497fef5838cb1da7c2d9f907fb419adba94696db709e0

(this sample)

AgentTesla

Executable exe 077ea1beb3d55288fae709ca1656bf8ddb08fca31dd675ac81de3980b7b3eaed

  
Dropping
MD5 43a1a67eb4de5ceb9a1adaf862ff9cc8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 077ea1beb3d55288fae709ca1656bf8ddb08fca31dd675ac81de3980b7b3eaed

Comments