MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6582e787248e58e093ee642918ca2a1b522d8452a792ad9695471538266623b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6582e787248e58e093ee642918ca2a1b522d8452a792ad9695471538266623b5
SHA3-384 hash: 1930728cfce218880d218c22de2e01f9e28ff9d7e83601ca5c7d6b1e345eaba67e06d333244bf432515f87de4a13cc23
SHA1 hash: e4496838212776759a14dce162f2472bd3d5a92b
MD5 hash: bd56d05763511b1203abe9d31e6ae3e5
humanhash: muppet-stairway-oregon-cold
File name:PWQHP1003529PDF.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:518'238 bytes
First seen:2020-07-21 18:42:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:KTIE67T7MnXvJgZX8GtmwJ5otABTa0aWvQRNqmG9w:4g3YXxgZX8uBJ5oqBT7QPL
TLSH D6B4230675A4321879FF8C316DE86DA522C9EB35C40D2D67274404EEB9F2A890F55EF8
Reporter abuse_ch
Tags:7z AgentTesla Endurance


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gproxy5-pub.mail.unifiedlayer.com
Sending IP: 67.222.38.55
From: admin@shaktiekprayas.com
Subject: New Inquiry from GFR Direct B.V
Attachment: PWQHP1003529PDF.7z (contains "PWQHP1003529PDF.exe")

AgentTesla SMTP exfil server:
webmail.saritatravels.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EOQO.16243.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6582e787248e58e093ee642918ca2a1b522d8452a792ad9695471538266623b5/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-07-21 18:43:06 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mwbopbzerzmobe7omqurrsrkdnjc3bcsu6jk3fuvi4ktqjtgeo2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6582e787248e58e093ee642918ca2a1b522d8452a792ad9695471538266623b5

(this sample)

AgentTesla

Executable exe e2a0cecb9bd8aead0154e241fa01f7876045513c426e20aaee46070a7375f50c

  
Dropping
MD5 031937e7f01c2aa358d6646bbc4537d8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e2a0cecb9bd8aead0154e241fa01f7876045513c426e20aaee46070a7375f50c

Comments