MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fcc7dbe57a4045b1566788a242f89dfe4d971d63e7154b6e697b848594eff26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fcc7dbe57a4045b1566788a242f89dfe4d971d63e7154b6e697b848594eff26
SHA3-384 hash: d3d164f8e2e1dd93d0eac038efd09c49ee0365514ecfdce552b2ecdbd7a6194bfecb7de08e5998002ecc02250ff6e2b5
SHA1 hash: 11f7c99f34bd92158450da0b282b15cb7ac2ccb6
MD5 hash: e988fe354986a1b9f4af998f6dd0ab56
humanhash: tennis-tennis-earth-freddie
File name:PO-Jiehong20959481.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:567'488 bytes
First seen:2020-08-31 13:09:21 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:ej7aJbQGxJptxQnGXdxLT2ccxNI7a+hPIxPhRMW3HwJ+:eHaDxrtayv8O7lOR3QA
TLSH 83C423B813BA9E39680222B7340E07D7DB619347E6D0492528DE9C53E693273F1BDCD9
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server0.intouchsport.net
Sending IP: 104.168.220.179
From: Helen Xia <office@intouchsport.net>
Subject: PO for Jiehong-20959481
Attachment: PO-Jiehong20959481.z (contains "PO-Jiehong20959481.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7fcc7dbe57a4045b1566788a242f89dfe4d971d63e7154b6e697b848594eff26/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 05:24:09 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p7gh3psxuqcfwflgpcfcil4j37sns4owhzyvjnxgs64eqwko74ta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7fcc7dbe57a4045b1566788a242f89dfe4d971d63e7154b6e697b848594eff26

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 7fcc7dbe57a4045b1566788a242f89dfe4d971d63e7154b6e697b848594eff26

(this sample)

AgentTesla

Executable exe b642527e686b781a602fb322e7d34d0f18748778de42a0e3774d9990a71e2c92

  
Dropping
MD5 ff286368558ae7854524c438ad15702b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b642527e686b781a602fb322e7d34d0f18748778de42a0e3774d9990a71e2c92

Comments