MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7973a6210ba1e0ebb035fcc0c0b02b043abfd725cfb9ea0b1c308daa3d6ca837. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7973a6210ba1e0ebb035fcc0c0b02b043abfd725cfb9ea0b1c308daa3d6ca837
SHA3-384 hash: ebec1ab2e0416280bf06f2ed5bf3d95bdebf20fe349931da6ac8a6d76dc60bba2fe6e21252dac21ba41ebd0d9e8d6c65
SHA1 hash: a8c5bbc6cc48da937c1ee8236d479af9bfdfc103
MD5 hash: 72f28f6c4c6e66239cdf2cab156d67d4
humanhash: connecticut-undress-timing-sierra
File name:New Order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:524'034 bytes
First seen:2020-10-06 06:11:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288://gccZ5IhDOtJynIxRLbEeL76fv5QZhh/emtA8lsFRdJDaC+1G://LcXIhDOtJ5bdL76HeZROvOw
TLSH 0FB423426A18A984197F4A9903B540BBC51D0E6F35ECB78F918A77EF433F85312BF821
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: Lisa <airmaster@cyber.net.pk>
Subject: New Order list
Attachment: New Order.zip (contains "New Order.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7973a6210ba1e0ebb035fcc0c0b02b043abfd725cfb9ea0b1c308daa3d6ca837/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 03:37:34 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pfz2miiluhqoxmbv7tambmblaq5l7vzfz646ucy4gcg2uplmva3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7973a6210ba1e0ebb035fcc0c0b02b043abfd725cfb9ea0b1c308daa3d6ca837

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7973a6210ba1e0ebb035fcc0c0b02b043abfd725cfb9ea0b1c308daa3d6ca837

(this sample)

AgentTesla

Executable exe e44a6bffebf7998e64b2668c6a20b597ccf00d81be8e4a425de0fbec7886c4bc

  
Dropping
MD5 543d670954fa95c7a2f875e7f11597e5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e44a6bffebf7998e64b2668c6a20b597ccf00d81be8e4a425de0fbec7886c4bc

Comments