MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7eab8eb80d60911a30f8b3ae7c8ea54606fa841b47cf84908b97747bbd8f686f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7eab8eb80d60911a30f8b3ae7c8ea54606fa841b47cf84908b97747bbd8f686f
SHA3-384 hash: 16041b8061148bb51326ccfe4228225a2de2683d96a083d4f1658735308ad7f4f70b7ad8392e8054b739a26661f1e956
SHA1 hash: 9736f7df55ec5cf0ad80aab6b228607fd5eac68b
MD5 hash: 4a2c6b990411c1282160372fb5efdcc1
humanhash: angel-shade-zulu-chicken
File name:Download_Tracking_Reference13-05-2020.xlsx.iso
Download: download sample
Signature AgentTesla
Create hunting rule
File size:489'472 bytes
First seen:2020-05-13 06:26:41 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:Atz4dQcqoTCDSSWTKvdZS+5IPr1u5erR3KGv:az6QchTEKyZS+maS3KW
TLSH 1EA4021F269C596FDBAD59B4D126110893F1AC54A5B0F3C87C9F64AAA7A33C00217BCF
Reporter abuse_ch
Tags:AgentTesla DHL iso


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: dhlSender@dhl.com
Subject: DHL EXPRESS SERVICE [YOU HAVE A PACKAGE READY FOR PICKUP]
Attachment: Download_Tracking_Reference13-05-2020.xlsx.iso (contains "Download_Tracking_Reference13-05-2020.xlsx.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 03:56:35 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p2vy5oanmcirumhywoxhzdvfiydpvba3i7hyjeels52hxpmpnbxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

iso 7eab8eb80d60911a30f8b3ae7c8ea54606fa841b47cf84908b97747bbd8f686f

(this sample)

AgentTesla

Executable exe e13fe4c80bcb450b7b811fa218cbd3ccc6a483470d07877dfa283ad4ac0d1042

  
Dropping
MD5 f736494686fd1e1b8789181ce4fbfc82
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e13fe4c80bcb450b7b811fa218cbd3ccc6a483470d07877dfa283ad4ac0d1042

Comments