MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07b77697adbb8e65f51512d64687351b4eb5f232c0e73c72d84d4d84f5ff2278. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07b77697adbb8e65f51512d64687351b4eb5f232c0e73c72d84d4d84f5ff2278
SHA3-384 hash: c05004d007054f8e88bf0e88106e8e69c1592a8e7ad5605158f64c4121bad1cb23ea11fac2236a7b5b1523bc99de2dae
SHA1 hash: 609920f4388beea0d41ac695733acd0de2ab1804
MD5 hash: 79d4a0f047250b2a7f6ee683c3151f1f
humanhash: paris-snake-gee-aspen
File name:RFQ50-05272020.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:491'559 bytes
First seen:2020-07-21 15:34:03 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:J9p/ecokL1z64i3cJQmIHRyz2gJuua5eHQcKny3yBpV0MSxD3hP:J9p/aAeOwoznJnaIHQznvBf0MSxDB
TLSH 36A4230A9539927C17BA94903B3ED82E3AB996B51343C1B281F1978611343970DFE6BF
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: scenicfruit.com
Sending IP: 37.48.85.246
From: marine Ambrosio<marine@scenicfruit.com>
Subject: RFQ#50-05272020
Attachment: RFQ50-05272020.pdf.z (contains "RFQ#50-05272020.pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07b77697adbb8e65f51512d64687351b4eb5f232c0e73c72d84d4d84f5ff2278/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 15:35:07 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a63xnf5nxohgl5ivcllenbzvdnhll4rsydtty4wyjvgyj5p7ej4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/07b77697adbb8e65f51512d64687351b4eb5f232c0e73c72d84d4d84f5ff2278

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 07b77697adbb8e65f51512d64687351b4eb5f232c0e73c72d84d4d84f5ff2278

(this sample)

AgentTesla

Executable exe 66c6414f4a169a4ca29b2952c76eca04c90add82afaa5410c8f447e39481853a

  
Dropping
MD5 2c5d9104790358f612354abeb705e598
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 66c6414f4a169a4ca29b2952c76eca04c90add82afaa5410c8f447e39481853a

Comments