MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dea4cf7d27a9b12d27799fe89123cfb36f03e0e495e12adbb4296b29ef0fd57c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dea4cf7d27a9b12d27799fe89123cfb36f03e0e495e12adbb4296b29ef0fd57c
SHA3-384 hash: 7373097e3d5938dff2e2baa11ef2a9a56aa5551f6432ddb0c4f3bfc05280bb583ceabe73ce0165328e76bc7e07a7ba95
SHA1 hash: 8be28ecf773a0a141b8f5ba5caff6ddcb7e1e28c
MD5 hash: ff1e45c55f11e02cdc124bd40d7ad5ee
humanhash: ten-uniform-victor-music
File name:order3454758575897464764647567.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:379'785 bytes
First seen:2020-07-22 07:10:05 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:5KSsTM6NpztA+DmaKVCaPSkmKYvpPjcwuo9MqiH04/3jb+fywifRDo90r3a0:5jh6NpztA+DXPkmRpP4wuo94HNzb+fgd
TLSH 3C84236D31F0CD2879F80B9293454AAEC5179DA60D0EEA89123361CFEB418FC4A557FC
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ptmatsuo.co.id
Sending IP: 202.74.72.84
From: Admin Purchase <admpurchase@gmail.com>
Subject: New Order
Attachment: order3454758575897464764647567.gz (contains "gunzipped")

AgentTesla FTP exfil server:
ftp.airporations.com:21

AgentTesla FTP exfil user name:
ace@airporations.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodGzip-A.7826.2141.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dea4cf7d27a9b12d27799fe89123cfb36f03e0e495e12adbb4296b29ef0fd57c/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 07:11:04 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=32sm67jhvgys2j3zt7ujci6pwnxqhyhesxqsvw5uffvst3yp2v6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz dea4cf7d27a9b12d27799fe89123cfb36f03e0e495e12adbb4296b29ef0fd57c

(this sample)

AgentTesla

Executable exe 759b4c280e580dd550ae1da28bb6a2fe7c2a53b3b4a9108d7328e0979ef7c84a

  
Dropping
MD5 8cf6a7a35df137ca7a96dead4c52d74d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 759b4c280e580dd550ae1da28bb6a2fe7c2a53b3b4a9108d7328e0979ef7c84a

Comments