๐Ÿคฒ๐Ÿผ NEW | abuse.ch Community Hub! Earn recognition ๐Ÿ… for the malware intelligence you share, climb the leaderboards ๐Ÿ“ˆ, and connect with like-minded contributors who share your hunting focus ๐Ÿค. Ready to unlock your profile? Go to the Community Hub โ†’

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 415ab07e275f4c2e8187b9f755bd71112c38b90643e852ab001ccd5efe0aafcc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 415ab07e275f4c2e8187b9f755bd71112c38b90643e852ab001ccd5efe0aafcc
SHA3-384 hash: e26ab2e5c5fd82eaeaacb9433a1894402e08100edd19d425c8c6c9d5bf613af6a7b8986b333c6231bf88d7940da28406
SHA1 hash: 3ea3ffe420f7a64d2a03eb1e580f461a40424980
MD5 hash: 81e4b5e2b72c42bb1e74a6f788f39bf4
humanhash: south-saturn-wolfram-blue
File name:RFQ-Order-PO-0586970-08-18-20-Quote,xlxs.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:665'008 bytes
First seen:2020-08-18 12:32:28 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:9BY4evGlothDBTXbD5El7P48+3R2ecftBSV6WjvD6wR9ZplBOi+tHROyZ0R/:/Y3tH/5O7g8+3R2QVDbmorplBOi+tf0h
TLSH 72E42322185BE5835D189D358EEC98518EDE0BFFA3B351CBE9E44981B8F11491E8F0B7
Reporter abuse_ch
Tags:7z AgentTesla geo KOR


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail-smail-vm44.hanmail.net
Sending IP: 203.133.180.232
From: ํ‘ธ๋ฅธํ•˜๋Š˜ <ash9943135@hanmail.net>
Subject: RFQ-่ฏขไปท/้‡‡่ดญ่ฎขๅ•
Attachment: RFQ-Order-PO-0586970-08-18-20-Quote,xlxs.7z (contains "RFQ-Order-PO-0586970-08-18-20-Quote,xlxs.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/415ab07e275f4c2e8187b9f755bd71112c38b90643e852ab001ccd5efe0aafcc/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 12:34:09 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ifnla7rhl5gc5amhxh3vlplrcewdroigipuffkyadtgv57qkv7ga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/415ab07e275f4c2e8187b9f755bd71112c38b90643e852ab001ccd5efe0aafcc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 415ab07e275f4c2e8187b9f755bd71112c38b90643e852ab001ccd5efe0aafcc

(this sample)

AgentTesla

Executable exe f8d6845e4bbaf3b148d938cebbe21d80cf53288e387abdaa7f7776c2ae89dcf5

  
Dropping
MD5 dce1929034ea7261d36b425eeca9e2a6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f8d6845e4bbaf3b148d938cebbe21d80cf53288e387abdaa7f7776c2ae89dcf5

Comments