MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e7883f19c5b2dbf9eb6d817e1e624e00e2989bf221d8524dd43ced86e1faa82. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e7883f19c5b2dbf9eb6d817e1e624e00e2989bf221d8524dd43ced86e1faa82
SHA3-384 hash: 64d0c6103ccef9176566cf7feb01375432df5d7fda8b59f12d5f377ecdaa7e52fbf8f8470da15d070e4ef510b4adaed1
SHA1 hash: 0596584d99f402403895f45e9c08060f11ff6344
MD5 hash: 09072d67f57f1087c0c17234401dfb25
humanhash: carolina-ceiling-mobile-speaker
File name:PO INOXIA-2020082.pdf.uue
Download: download sample
Signature AgentTesla
Create hunting rule
File size:256'159 bytes
First seen:2020-08-04 15:39:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:r1NB30Lc8ctqGTbdolVdrTHEhLAj1pq4YkhrxXqvNHmr:d3kStvbdAhLEy1xPXgS
TLSH F74423B7A528B36D52C042CA0CC4B40FB5CE69D25C791925F931DBD42F49DCECA23AB2
Reporter abuse_ch
Tags:AgentTesla uue Yahoo


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic315-20.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.190.146
From: OSTO TRADE & CONSULTING GMBH <alexandy40@yahoo.com>
Reply-To: OSTO TRADE & CONSULTING GMBH <alexandy40@yahoo.com>
Subject: Re: RE: PO INOXIA
Attachment: PO INOXIA-2020082.pdf.uue (contains "PO INOXIA-2020082.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FVT3FB4CB29F638.9537.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7e7883f19c5b2dbf9eb6d817e1e624e00e2989bf221d8524dd43ced86e1faa82/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 15:41:04 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pz4ih4m4lmw37hvw3al6dzre4ahctcn7eioykjg5iphnq3q7vkba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7e7883f19c5b2dbf9eb6d817e1e624e00e2989bf221d8524dd43ced86e1faa82

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7e7883f19c5b2dbf9eb6d817e1e624e00e2989bf221d8524dd43ced86e1faa82

(this sample)

AgentTesla

Executable exe 9018fc4955a89ca4996540770fb9d7ed349810b9e4f6724ade1be9c6288015ed

  
Dropping
MD5 3fb4cb29f6380861a446414eb3896dd7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9018fc4955a89ca4996540770fb9d7ed349810b9e4f6724ade1be9c6288015ed

Comments