MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8d904d687d62196fb7a171e7a7faa5bfc89eed502a44c3bd43240d48380f7b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8d904d687d62196fb7a171e7a7faa5bfc89eed502a44c3bd43240d48380f7b3
SHA3-384 hash: 30f57d82cf43cb7cb4fb6f0fe0c18ece78077da9ffe0de0fcf5156a8ae1a4c0806ab129f27f52fc31c53d646da17e853
SHA1 hash: 097c8e06c17cf9dd442080f4636cd3388fa5b51b
MD5 hash: 2214f6c4e6eaabd82a47c57335eda16a
humanhash: finch-london-november-double
File name:TT COPY_PDF.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:906'544 bytes
First seen:2020-06-15 05:32:30 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 24576:uFAHtv+34uOGcdisHP9PrihkXlfUKo0Ev:uGH44JGk1fUX
TLSH D315330091DBA2B27E6A950853D1686F28C28D31C63FC9D35ACD03F27D6B6357DFA524
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server1.limecreative.gr
Sending IP: 46.4.56.202
From: Albert spiff <wynn@wysen.com>
Subject: RE: TT PAYMENT
Attachment: TT COPY_PDF.7z (contains "TT COPY_PDF.exe")

AgentTesla SMTP exfil server:
montana.co.ke:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Script-AutoIt.Trojan.AitInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 05:34:05 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vdmqjvuh2yqzn632c4phu75klp6it3wvakseyo6ugjanja4a66zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z a8d904d687d62196fb7a171e7a7faa5bfc89eed502a44c3bd43240d48380f7b3

(this sample)

AgentTesla

Executable exe c72bce28d1e0909a66971dfa01aa823b767a73da5cedc0679e962dc9230fdf56

  
Dropping
MD5 78dd2cf924dbf30d35baed31845bb6e5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c72bce28d1e0909a66971dfa01aa823b767a73da5cedc0679e962dc9230fdf56

Comments