MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d4ae0a1ceacf4923a75cd15fff0328d424bc36c037a12300293898dc8125498. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7d4ae0a1ceacf4923a75cd15fff0328d424bc36c037a12300293898dc8125498
SHA3-384 hash: ee8e331317d19fbc12e1365654536060dfc5960d2e3c697ccea5befd9a34647f88792b962da7d7503fb56d4934dff818
SHA1 hash: b6e57503e1c5dfa53c58f15c13744f4fcfcfdfef
MD5 hash: 9086259c66b8c71d5d4db6808ac70838
humanhash: king-coffee-yellow-march
File name:Shipping Documents-097100.pdf.uu
Download: download sample
Signature AgentTesla
Create hunting rule
File size:2'941'800 bytes
First seen:2020-07-29 06:49:36 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 49152:JGkyMrrZJHRKId/Pv5jAGddk48mPG5iQH+jpxv1gEPIIS4xtkM//9+3/3zhBdunR:J5rXHRLdnv58Mdt8KQHAT1JJUMI/lBQR
TLSH 8FD533A8446B408C2A296FB00E938D4852DB99E1D1CE17F5F5E71ABFA055F39EF39310
Reporter abuse_ch
Tags:AgentTesla uu


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.radheshyamengines.partners
Sending IP: 162.241.204.242
From: GG BULK SHIPPING LTD. <ortobennett@ortobennett.com>
Subject: Shipping Documents
Attachment: Shipping Documents-097100.pdf.uu (contains "Shipping Documents-097100.exe")

AgentTesla SMTP exfil server:
mail.hajartrading.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7d4ae0a1ceacf4923a75cd15fff0328d424bc36c037a12300293898dc8125498/
Threat name:
Win32.Trojan.DataStealer
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 06:51:10 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pvfobioovt2jeotvzuk774bsrvbexq3man5bemacsoey3sasksma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/7d4ae0a1ceacf4923a75cd15fff0328d424bc36c037a12300293898dc8125498

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 7d4ae0a1ceacf4923a75cd15fff0328d424bc36c037a12300293898dc8125498

(this sample)

AgentTesla

Executable exe 22165d0974fa72f7e87c8e5128cd1fc3fe6b6dc0ed8e990838229b3a92234349

  
Dropping
MD5 997504b4b4392233e29484349d3915e1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 22165d0974fa72f7e87c8e5128cd1fc3fe6b6dc0ed8e990838229b3a92234349

Comments