MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e7dd7dcd329ac1d5cfd7648d211ba066a4131f5f273f7b7a2be546e973d8b4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e7dd7dcd329ac1d5cfd7648d211ba066a4131f5f273f7b7a2be546e973d8b4c
SHA3-384 hash: eba35b84bb5120e33d3aa1b0f4b1e12f5cd3ddf3f0c3aed2fa18d45dec5961f7de09304b5c1849e5c1a31085e07143dc
SHA1 hash: d38e43237d95cdbb6d27ef0d01de39b79ae0d437
MD5 hash: cb77082c32465ecd63b233db112a6065
humanhash: kitten-timing-cup-football
File name:SOA_1300003150.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:573'016 bytes
First seen:2020-08-31 09:18:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ahjhOjLliBbbfYb1Pr0o7D2kSFKvkw4LLLApoJLHWnt:hjLlK8b50fFzhLEiJLH0
TLSH E4C423CD994247EFF613BD95F461EB6E61150E93232D8D7A462C9DFE804286620C3CD7
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hlag.com
Sending IP: 37.49.230.8
From: doc.dhl<doc.hk@hlag.com>
Subject: BL HLCL Sh#86365840 Doc#HLCUHKG2008AUCR5
Attachment: SOA_1300003150.zip (contains "SOA_1300003150.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Trojan-7.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4e7dd7dcd329ac1d5cfd7648d211ba066a4131f5f273f7b7a2be546e973d8b4c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 02:59:34 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jz65pxgtfgwb2xh5ozeneen2azvecmpv6jz7pn5cxzkg5fz5rnga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/4e7dd7dcd329ac1d5cfd7648d211ba066a4131f5f273f7b7a2be546e973d8b4c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4e7dd7dcd329ac1d5cfd7648d211ba066a4131f5f273f7b7a2be546e973d8b4c

(this sample)

AgentTesla

Executable exe 6ef9a45a617adf0e0ff740e37c865325289a110394725c393c314a3128a2575f

  
Dropping
MD5 050ae1e55bc621adde8ba33140ca1cc7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6ef9a45a617adf0e0ff740e37c865325289a110394725c393c314a3128a2575f

Comments