MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b7dc4d2703a1b2b4b3974898cc0caa612ffa490268e3fe475ec6bdb0104dfa0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b7dc4d2703a1b2b4b3974898cc0caa612ffa490268e3fe475ec6bdb0104dfa0
SHA3-384 hash: 747a4f5c1710e1e8790f5638cd8b3d05eeabc7c3729d3a97d57590ddff1860837399ef7190f9f2ce1f2a8baeb75d094c
SHA1 hash: 530338e5141be32e4461a74692eda14bdec8630b
MD5 hash: 9f7215226325d042b555eb82c57dda79
humanhash: harry-pip-oxygen-georgia
File name:Payment Receipt.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:411'930 bytes
First seen:2020-08-17 06:35:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:s86isnjLZ6yj7vX1R+xJ3FOa26EG/MTzbYfq94GmrNpcf1pXYPWh9b2YVp:sfjnjV6yjDXX+/FO8EG/MTYfxD6Yi9bz
TLSH 0B942364E6EC798B17C7FC349EAE4342CACB2AA018A370ED7D1CE7D32427949855B125
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Ngoc My <ngocmy.ta@bitisgroup.vn>
Subject: FW: Balance Payment Receipt
Attachment: Payment Receipt.pdf.z (contains "Payment Receipt.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis688996FD080C.21025.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b7dc4d2703a1b2b4b3974898cc0caa612ffa490268e3fe475ec6bdb0104dfa0/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 02:30:46 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jn64jutqhinswszzoseyzqgkuyjp7jeqe2hd7zdv5rv5waie36qa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/4b7dc4d2703a1b2b4b3974898cc0caa612ffa490268e3fe475ec6bdb0104dfa0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4b7dc4d2703a1b2b4b3974898cc0caa612ffa490268e3fe475ec6bdb0104dfa0

(this sample)

AgentTesla

Executable exe 860a68354fad849f4d5886f00c701638d1226088d4ca26c07216d089f986a7bb

  
Dropping
MD5 688996fd080ce40ddb6da1e09eaad838
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 860a68354fad849f4d5886f00c701638d1226088d4ca26c07216d089f986a7bb

Comments