MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07233642c7950281930d250fd04fc125415df3e90f2116c0df97658af8249f09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07233642c7950281930d250fd04fc125415df3e90f2116c0df97658af8249f09
SHA3-384 hash: fa2b078014c032c9809f479c3965c2be2c9db364de65a2c59b5a1f803da8e3ef585404606c744dfa984ffb8f417a07f4
SHA1 hash: 0d776ab214bb4ee584f4f187e68a219ad808b532
MD5 hash: 4c0c53532dcbabac4be87563159fc736
humanhash: maine-south-zebra-victor
File name:Products description.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:302'584 bytes
First seen:2020-07-30 07:30:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:xsF4dTPztxXKbgfI8PlIwk9IaMScEF7+4twVvFqNy+QxXsdwF7:xZdTPZxXy8SwbJNmq4uJFqvkkwF
TLSH 265423CC3B1BED92CD0304963251D7660E3113AEE755F9E9579A2365983A732E0BB3C8
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: m9749.mail.qiye.163.com
Sending IP: 220.181.97.49
From: Right Cheung <sales08@shinepackaging.com>
Subject: Re: Products description
Attachment: Products description.zip (contains "Products description.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07233642c7950281930d250fd04fc125415df3e90f2116c0df97658af8249f09/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 07:32:07 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a4rtmqwhsubideyneuh5at6bevav347jb4qrnqg7s5syv6bet4eq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/07233642c7950281930d250fd04fc125415df3e90f2116c0df97658af8249f09

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 07233642c7950281930d250fd04fc125415df3e90f2116c0df97658af8249f09

(this sample)

AgentTesla

Executable exe ba4c584519a8fa8a90a906dea86ebe75bb3464190a152467d32ebdefcfc4e643

  
Dropping
MD5 19987543a96c675d45ac4e7212d2f465
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ba4c584519a8fa8a90a906dea86ebe75bb3464190a152467d32ebdefcfc4e643

Comments