MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 645c1e4f93235c42de948f4c2757da73692c24f0bb2e8058e7d64ead0ea4a0de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 645c1e4f93235c42de948f4c2757da73692c24f0bb2e8058e7d64ead0ea4a0de
SHA3-384 hash: 67fe9658d66a00edaef407eaafd59b943d9692badbcf9741810e05b7cb6ad42b96afeebc902fcbb5092b75e3d32d96d8
SHA1 hash: 167efa04d79e79cbd7d4379662e4ccdbe864da6e
MD5 hash: 42f06bdb02f5ab58381784590dc5f634
humanhash: sink-friend-tennis-apart
File name:RFQ-PO-05869700_200-MT_Sample,pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:621'506 bytes
First seen:2020-11-26 09:35:10 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:Ylv8dm8imslC1U0/DsuZbgS6mprgZYwi0LahJqs:YtkjsuZvdrg5i0LahJqs
TLSH F4D4230AE7E227D89CD23A22E5DDA731DE4199DC66CF187C856DFCD29E48A603C1DC60
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail-smail-vm45.hanmail.net
Sending IP: 203.133.180.233
From: 김기배 <kkb8037@hanmail.net>
Subject: URGENT: Request For Quotation/Order
Attachment: RFQ-PO-05869700_200-MT_Sample,pdf.7z (contains "RFQ-PO-05869700_200-MT_Sample,pdf.exe")

AgentTesla SMTP exfil server:
mail.wowwow.com.sg:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/645c1e4f93235c42de948f4c2757da73692c24f0bb2e8058e7d64ead0ea4a0de/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-11-26 09:36:06 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mrob4t4tenoefxuur5gcov62onusyjhqxmxiawhh2zhk2dveudpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 645c1e4f93235c42de948f4c2757da73692c24f0bb2e8058e7d64ead0ea4a0de

(this sample)

AgentTesla

Executable exe 08ae3a735881e41099740e2e79fcd4107d5e94fe9267e28d6bf8bd9fd80a7ce6

  
Dropping
MD5 ce6623d5bd383baed62f68dfff661f92
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 08ae3a735881e41099740e2e79fcd4107d5e94fe9267e28d6bf8bd9fd80a7ce6

Comments