MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7da8366128fc796c5973bad384fbb8863bb2cbf14b4f1230acc3a395db190141. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7da8366128fc796c5973bad384fbb8863bb2cbf14b4f1230acc3a395db190141
SHA3-384 hash: b4968ed6b945d45783a8f85ff00478c22c56551b3d0462a82167b272e3724f6a08f94d27e7b121495ee73636a917639a
SHA1 hash: db0aa4ead2bbef8f5e3ebfeb702f3fe99c0e5ea1
MD5 hash: 1d663545f01c4fa53f31ee542e8f7e53
humanhash: fifteen-alanine-muppet-tennessee
File name:TOYO_Ms General conditio.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:390'753 bytes
First seen:2020-08-05 09:06:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:l8tONW1UzvOQvOKxbkiLuNH9BBCiAR2PZkZtAAsikKFmvMuBmPnrUR8cM8Oq9ZmX:qtOxzmQm9uuNc92PZk4AYQ1gub/fP
TLSH 0F8423B521C950D44483B9D9082C3BA99EE706CDE68842CB99350FE7E4741F06F9FDBA
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: Toyo Engineering & Construction Sdn Bhd <jjhyd@cyber.net.pk>
Subject: RE: TOYO ENGINEERING FINAL REMINDER [PR742 BIO-MEG] AYBF001 Hot Oil Heater / RFQ / Toyo Engineering & Construction Sdn. Bhd
Attachment: TOYO_Ms General conditio.zip (contains "TOYO_Ms General conditio.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7da8366128fc796c5973bad384fbb8863bb2cbf14b4f1230acc3a395db190141/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:08:07 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pwudmyji7r4wywltxljyj65yqy53fs7rjnhremfmyorzlwyzafaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/7da8366128fc796c5973bad384fbb8863bb2cbf14b4f1230acc3a395db190141

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7da8366128fc796c5973bad384fbb8863bb2cbf14b4f1230acc3a395db190141

(this sample)

AgentTesla

Executable exe 6a304eb65d7aaf500fa186406ed9bd3f02394251010b24aec66ed92a0fd71d90

  
Dropping
MD5 2e33fb697e29b12ade0ec2ab18a9abe3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6a304eb65d7aaf500fa186406ed9bd3f02394251010b24aec66ed92a0fd71d90

Comments