MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7cf6de390083baa2eef3966765be1939f85f55a2e69f1c447341c88cc39d5b11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7cf6de390083baa2eef3966765be1939f85f55a2e69f1c447341c88cc39d5b11
SHA3-384 hash: 560def0d63b75b648782519a6bf002e3b7d81219ec16b2c20f1754dff0ec8d4341b39872e01c53b434b273a502368fba
SHA1 hash: 9993d54552569bc5b01e1fbcfc299260e8c5a131
MD5 hash: 5bf3f6490a0cc35c063639cfa40b9f3b
humanhash: winner-blossom-kilo-illinois
File name:RFQ-OGH733_pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'507'328 bytes
First seen:2020-05-01 13:14:31 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:xBt420HvsCQFhTNBlb2L/xLP+9j8lkxRXpek:xJWvYHNb2L/9uj9RXpe
TLSH DE659CE0CE86D50ED2AE05F4C45DD14AC6F8EF4A6382FF586948B3A819B220DCCD55F6
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.en-plasnic.com
Sending IP: 89.32.41.129
From: Ms Diana Ali <xtrader@en-plasnic.com>
Subject: RFQ-OGH733
Attachment: RFQ-OGH733_pdf.img (contains "RFQ-OGH733_pdf.scr")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.43686.8431.11169.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 13:35:49 UTC
File Type:
Binary (Archive)
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pt3n4oiaqo5kf3xtsztwlpqzhh4f6vnc42pryrdtiheizq45lmiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 7cf6de390083baa2eef3966765be1939f85f55a2e69f1c447341c88cc39d5b11

(this sample)

AgentTesla

Executable exe acd3a83423dcabf68bbb38ebc886f923fd1c5ba2fbf13f68e377f8895a1c5073

  
Dropping
MD5 7cf3f6bad69e193a003c042916e2f528
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 acd3a83423dcabf68bbb38ebc886f923fd1c5ba2fbf13f68e377f8895a1c5073

Comments