MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7cabc301511c8178a9f65d09ad13ab6ddd8d320498b621cb6efcd3d792efa215. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7cabc301511c8178a9f65d09ad13ab6ddd8d320498b621cb6efcd3d792efa215
SHA3-384 hash: b89701a52115e39fc5ca2943ab14282c2ec5fcb90705636667d350161acec1c830c3cdeb9bb3475fd34c02ef0a018653
SHA1 hash: 754b1ded8cb94dd0aa2ae613c459b8fb72fa62bc
MD5 hash: d95a1b607ca2c3560be46a295ebac66b
humanhash: october-kitten-ohio-helium
File name:RFQ FGPWI144.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:425'281 bytes
First seen:2020-08-06 06:08:21 UTC
Last seen:2020-08-08 13:06:58 UTC
File type: gz
MIME type:application/x-rar
ssdeep 12288:2GbPJi2g/JlCVHj7RTxRTD5jBpEEAhO7R5tw8fxICuxf:2GbPJiLlu5TxRTD5jBiEvtzfxIC+f
TLSH A19423A826F7132E41D10E385E07C901F1378D92FC89D51A28D96EB911E1987FF9DF2A
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: yawingroup.com
Sending IP: 37.48.85.232
From: Jacy Zheng <sales@yawingroup.com>
Subject: REQUEST FOR QUOTATION
Attachment: RFQ FGPWI144.pdf.gz (contains "RFQ# FGPWI144.pdf.exe")

Intelligence

File Origin
# of uploads :
19
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7cabc301511c8178a9f65d09ad13ab6ddd8d320498b621cb6efcd3d792efa215/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 06:10:08 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=psv4gakrdsaxrkpwlue22e5lnxoy2mqetc3cds3o7tj5pexpuikq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7cabc301511c8178a9f65d09ad13ab6ddd8d320498b621cb6efcd3d792efa215

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 7cabc301511c8178a9f65d09ad13ab6ddd8d320498b621cb6efcd3d792efa215

(this sample)

AgentTesla

Executable exe 9094c14f4aefb639b44ba97324bcef8c07ce9d789b3f34a3285157e90e1792a1

  
Dropping
MD5 fd91f91ff53d62235a5f56894505ac2f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9094c14f4aefb639b44ba97324bcef8c07ce9d789b3f34a3285157e90e1792a1

Comments