MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d424ebac88ac6b91b12abda0c1c548c5e74b1241040509668732b3f1d4c2b2ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d424ebac88ac6b91b12abda0c1c548c5e74b1241040509668732b3f1d4c2b2ef
SHA3-384 hash: b03a531d4d7171ff662a6d90d4abe16cb5962e79a818262f6e1d4001a55852dbd2e575d7f98eb920c2e10015ae2ff460
SHA1 hash: 58672d432e9e1b2ad15d1a01e379492085c24edb
MD5 hash: 45674e014ca4d8250c3ee58212cf8adf
humanhash: jersey-avocado-monkey-romeo
File name:PO - 9093755372.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:279'627 bytes
First seen:2020-07-13 11:06:42 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:5flIRiffhd2zKE+wWsg8gGe4h7ZK7PsUxLJSK4IAEBjtO4xjfuhz9ra8+a:a0h0r+Kff7w7PfxLJS2AEBM41oz928L
TLSH DC54233BD02CDC874C039DBEF307FA23A932E2A6466E9852E548528D1B3575049D9B7F
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.amdigital.ro
Sending IP: 176.126.172.55
From: Dennis Olson - Vinta trading company <sales@vinta.com>
Subject: Re: NEW ORDER
Attachment: PO - 9093755372.7z (contains "YdvJnnnDX0FUKjI.exe")

AgentTesla SMTP exfil server:
mail.arhigraf.ro:587

AgentTesla SMTP exfil email address:
aszocs@arhigraf.ro

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d424ebac88ac6b91b12abda0c1c548c5e74b1241040509668732b3f1d4c2b2ef/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 11:08:05 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2qsoxleivrvzdmjkxwqmdrkiyxtuwesbaqcqszuhgkz7dvgcwlxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z d424ebac88ac6b91b12abda0c1c548c5e74b1241040509668732b3f1d4c2b2ef

(this sample)

AgentTesla

Executable exe 6fae5955bfeac6e762f65fabedb2be2fdcd385347e6b9db19825096ee2ebd9a1

  
Dropping
MD5 1795c0e7a5c67752a3e13c5a0f6ce9af
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6fae5955bfeac6e762f65fabedb2be2fdcd385347e6b9db19825096ee2ebd9a1

Comments