MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24be7f8eb88df622bbd1f88d1f63233e894d4b681dc9540d84c33b85a4d446b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24be7f8eb88df622bbd1f88d1f63233e894d4b681dc9540d84c33b85a4d446b1
SHA3-384 hash: 271d0499d7766734c7afd9d490eecc73187d0f0efd6ff6748585568d0f0884f12943842d07d978285391c8fadf7a612c
SHA1 hash: 680e24b58730f8c22813e657069f118a7b0298d5
MD5 hash: 50feb1f370567dce96ddb58f4f9fe855
humanhash: mike-low-jig-low
File name:51190476789.pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:384'300 bytes
First seen:2020-06-15 05:34:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:cV2L8kpMBD085+SRmYOZxCBjjBCs6Iyj5HZqvmPoF6Sh8hIl+8tS3kfLekYCun:c4okcD08s2tBhCNNcuPogSmIlDs3k4Nn
TLSH 0C842396FEA844E00E97C0729D438411DFB42742EC7993E60C1A439D62ACABBFC46DF5
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: regular1.263xmail.com
Sending IP: 211.150.70.196
From: 杨轲 <yangke@cese3.com>
Subject: Re: New Order
Attachment: 51190476789.pdf.7z (contains "Neworder5119047pdf.exe")

AgentTesla SMTP exfil server:
webmail.siancoeg.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.34016426.19424.29719.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 05:36:05 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=es7h7dvyrx3cfo6r7cgr6yzdh2eu2s3idxevidmeym5yljgui2yq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 24be7f8eb88df622bbd1f88d1f63233e894d4b681dc9540d84c33b85a4d446b1

(this sample)

AgentTesla

Executable exe 968a7bf9593f8635bc6383f73cc1743b4fa776442ec7265adc138f248531bfbf

  
Dropping
MD5 71894434f256436d126e77c7307ce2cd
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 968a7bf9593f8635bc6383f73cc1743b4fa776442ec7265adc138f248531bfbf

Comments