MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2f7d1c43f0f763b1d689a602d4d9e6b0faf25a7773fdc9b12705dab485f0391. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e2f7d1c43f0f763b1d689a602d4d9e6b0faf25a7773fdc9b12705dab485f0391
SHA3-384 hash: 90c6d20c6a4f01dc32f01f350296a9036bcd063d9cc8b3c25c106ac49c52fd771f6314bf03130d5005e448345c724239
SHA1 hash: dabf4dab4b23aedffaf349b64c1267e08ea047bd
MD5 hash: c56095b491dec7c3d16379414b41179a
humanhash: louisiana-bravo-crazy-bakerloo
File name:INV45662019.PDF.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:401'850 bytes
First seen:2020-07-16 19:00:04 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:Cndboedwf/SW3O4j2lkHRTlwcvp5ErywcDWWxD4Z:Cn5bwXlO4j2laBYywcDZl4Z
TLSH 9284239F023A44B1B7FAB0D863A7B20970737CA5992B482D0960559FDBCF38F2B55178
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.y-tasarim.com
Sending IP: 94.102.13.164
From: Deborah L. McCoy <sales@kerpiccigroup.com>
Subject: Invoice
Attachment: INV45662019.PDF.7z (contains "INV#45662019.exe")

AgentTesla SMTP exfil server:
mail.dogulumetal.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e2f7d1c43f0f763b1d689a602d4d9e6b0faf25a7773fdc9b12705dab485f0391/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 19:01:04 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4l35drb7b53dwhlitjqc2tm6nmh26jnho475zgysobo2wsc7aoiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z e2f7d1c43f0f763b1d689a602d4d9e6b0faf25a7773fdc9b12705dab485f0391

(this sample)

AgentTesla

Executable exe 13f7a30f58afa7f483fea6a837b9404bb70e0e491522f95a59d07780974580e1

  
Dropping
MD5 fc298909af8cc330d50f74fb14ae4e7f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 13f7a30f58afa7f483fea6a837b9404bb70e0e491522f95a59d07780974580e1

Comments