MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7864117cebfb9fa69b4a4b84ea2536752ae27b8d984be93c5dcedd90a806e29a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7864117cebfb9fa69b4a4b84ea2536752ae27b8d984be93c5dcedd90a806e29a
SHA3-384 hash: dc2e18e64204d7bc94102b3de676c8d92d9f43d539b5093dab0b6409b237bd3657318330c8392494fe40fbef2e68bdae
SHA1 hash: 5bfb71c94050a553006ea69e9cb73e4ff204147e
MD5 hash: ece7df6d26b472b31b437e370d923a6f
humanhash: hamper-montana-east-arizona
File name:Purchase Order for 0514 BUY F20.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:450'265 bytes
First seen:2020-08-08 08:30:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:8NWF4196Y2CPr2/cvZFnGUVnCJ7KYmgit4:8Pi3IZFnzVnQ3mgP
TLSH 35A4233C1D0D40EB91D4AF8BA7769B17CCD625EC537AB883B77D908B34D9C108B115AA
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: jiuyutex.com
Sending IP: 103.99.1.149
From: Katharina.hong<Katharina.hong@jiuyutex.com>
Subject: RE:[COLUMBIA] Purchase Order for 05/14 BUY_F20_SHANGHAI JIUYU_ATC VN
Attachment: Purchase Order for 0514 BUY F20.zip (contains "Purchase Order for 0514 BUY F20.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7864117cebfb9fa69b4a4b84ea2536752ae27b8d984be93c5dcedd90a806e29a/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-08 00:59:29 UTC
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pbsbc7hl7op2ng2kjocoujjwouvoe64ntbf6spc5z3ozbkag4kna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7864117cebfb9fa69b4a4b84ea2536752ae27b8d984be93c5dcedd90a806e29a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7864117cebfb9fa69b4a4b84ea2536752ae27b8d984be93c5dcedd90a806e29a

(this sample)

AgentTesla

Executable exe 64c51fc10708dbd2fb676b2a95bd1330d4fe8099384713d0bea70c0c17928fec

  
Dropping
MD5 743de1f2483fb363557d2ee148839461
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 64c51fc10708dbd2fb676b2a95bd1330d4fe8099384713d0bea70c0c17928fec

Comments