MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ddfea46f5d682447dc796a3a433c34ee9460023abc934d710b0c7f50fd2abac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ddfea46f5d682447dc796a3a433c34ee9460023abc934d710b0c7f50fd2abac
SHA3-384 hash: 65a5a3e0ce503f9e92dbe535fb1a6db7962ca119792d70c30f746556b60e00cb15ff1768825128b56178441ac2ff7590
SHA1 hash: 225b1ba0d07050dfe946bb56a9b0c22e90e5b61d
MD5 hash: 078db4d9f514e2874e9d8da0b785163a
humanhash: venus-muppet-august-fix
File name:Draft BL-Copy.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:570'533 bytes
First seen:2020-07-30 07:44:02 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:eVpYcmy039RDgUsXOezMygUm0ta15VQoCJX1s7:oCcG3rsDXONzU1wVvgs7
TLSH A5C423C1414D31B639D436273D45422BF563060E3AFB15BAFC3357B89388EEA6886ADD
Reporter abuse_ch
Tags:AgentTesla Endurance gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 192-254-193-67.unifiedlayer.com
Sending IP: 192.254.193.67
From: Chavanun/Mastertrans <marketing@mastertrans.co.th>
Subject: Urgent: CONFIRM DRAFT B/L BOOKING NO I488156320
Attachment: Draft BL-Copy.gz (contains "Draft BL-Copy.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ddfea46f5d682447dc796a3a433c34ee9460023abc934d710b0c7f50fd2abac/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-07-30 07:45:07 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pxp6urxv22bei7ohs2r2im6dj3uumabdvpetjvyqwdd7kd6svowa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/7ddfea46f5d682447dc796a3a433c34ee9460023abc934d710b0c7f50fd2abac

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 7ddfea46f5d682447dc796a3a433c34ee9460023abc934d710b0c7f50fd2abac

(this sample)

AgentTesla

Executable exe 1bb2e1d32abda0d9df006925e4a49ca8f2528a21491f82b231205ddc244d277b

  
Dropping
MD5 b9f044e3a06adb9eba2d4c1cb3950bc9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1bb2e1d32abda0d9df006925e4a49ca8f2528a21491f82b231205ddc244d277b

Comments