MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 edf0562ed25e2cac70ae9a6a98002fb33871eb7a47d48cd7ba0b729a2dbf6c8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: edf0562ed25e2cac70ae9a6a98002fb33871eb7a47d48cd7ba0b729a2dbf6c8b
SHA3-384 hash: 9b0f7fe331ec4768f24fde52ae1061996708136f9934df5f4f87f8c84f4bb3769e6113f1f9dd87aee2d57ce28452bc81
SHA1 hash: 7d1a27807a24a14b30245583870787ca37ea7655
MD5 hash: 1c0e9515a76d50a313fbd68c898eb073
humanhash: jersey-colorado-bacon-connecticut
File name:payment slip pdf.7Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:419'730 bytes
First seen:2020-07-21 06:23:55 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:M6ZnrR/22pM0M7m1WUMTfqFzO6GcvZ/7StOTlE2u:Bt0gtn4639TlEP
TLSH 2794232914B7B9DE813D23DEE819186B3C4A7DD764D1FD76C6180236E2AC6771BE2208
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.eldorado.com.uy
Sending IP: 190.64.204.53
From: Florencia Diaz <fldiaz@eldorado.com.uy>
Subject: Proforma Invoice July 2020
Attachment: payment slip pdf.7Z (contains "payment slip pdf.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27342.RarHeur.v5.HideExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/edf0562ed25e2cac70ae9a6a98002fb33871eb7a47d48cd7ba0b729a2dbf6c8b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 06:25:11 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5xyfmlwslywky4fotjvjqabpwm4hd232i7kizv52bnzjuln7nsfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/edf0562ed25e2cac70ae9a6a98002fb33871eb7a47d48cd7ba0b729a2dbf6c8b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z edf0562ed25e2cac70ae9a6a98002fb33871eb7a47d48cd7ba0b729a2dbf6c8b

(this sample)

AgentTesla

Executable exe 9b8bfd519d8bbe5a7c285f61c73abef27b4e18a22076d036698ec943b5e61c01

  
Dropping
MD5 73446b4f7828240c2176f6dbac0db41e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9b8bfd519d8bbe5a7c285f61c73abef27b4e18a22076d036698ec943b5e61c01

Comments