MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd7a080377bc3629e0a032311b134c1bc6a1d163ce669d3756b581500e590a25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd7a080377bc3629e0a032311b134c1bc6a1d163ce669d3756b581500e590a25
SHA3-384 hash: aa90fe66f060a6e54baeb31493dc5b05a5c4b354178131584269d0861aaa2048c4c06bfac70459f2e529d2b03c8f12bb
SHA1 hash: 1cdf42170c5f1dc9af2a8e137993a6ab45e51502
MD5 hash: bbc2d2f2450791bf589e8556d0365a21
humanhash: leopard-burger-sweet-florida
File name:SHIPPING DOCUMENTS Pdf.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:512'716 bytes
First seen:2020-07-13 05:25:04 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 12288:mOj3mvynITlalSZnW9wGkVWDAf+A1YhC2eyjBnU6DZ59fxWGNCx/+:f3mLTCSlW94gDq+55NNDZHfUF/+
TLSH 50B423E72714A7F863F27DD48AA5DFF7885A62E481D94110F8EE73A6D8911F3C810878
Reporter cocaman
Tags:AgentTesla xz


Avatar
cocaman
Malicious email
From: =?UTF-8?Q?=E9=92=9F=E5=85=B0=E8=8A=B3?= <zhonglanfang@hilikvision.com>
Received: from 142-4-22-49.unifiedlayer.com (142-4-22-49.unifiedlayer.com [142.4.22.49])
Date: Sun, 12 Jul 2020 18:39:10 -0600
Subject: SHIPPING DOCUMENTS
Attachment: SHIPPING DOCUMENTS Pdf.xz

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd7a080377bc3629e0a032311b134c1bc6a1d163ce669d3756b581500e590a25/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 05:27:04 UTC
File Type:
Binary (Archive)
Extracted files:
93
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3v5aqa3xxq3ctyfagiyrwe2mdpdkduldzztj2n2wwwavadszbisq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz dd7a080377bc3629e0a032311b134c1bc6a1d163ce669d3756b581500e590a25

(this sample)

AgentTesla

Executable exe 73dc86ee57793216e08fdd43cf42a086245e9d0980b741d62263196295d06bd5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 73dc86ee57793216e08fdd43cf42a086245e9d0980b741d62263196295d06bd5
  
Dropping
AgentTesla

Comments