MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a1ed1d24e2c6bbf6e164df66009c0b94061e3b02cd93e6dbb4cac125640fabc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a1ed1d24e2c6bbf6e164df66009c0b94061e3b02cd93e6dbb4cac125640fabc
SHA3-384 hash: ccb8fcc1f27dbbff89702609f54cacb66a0297bf451e58b9a24b7713f5e56af97548e8af3d276c9ef122081069403d3f
SHA1 hash: 2b9af52bec3db0a5100f1372bce134a3d1cc8b0b
MD5 hash: 8833867b0248e4026d7c320ad86194e7
humanhash: speaker-stairway-steak-bluebird
File name:New Order Inquiry-2020513.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:427'613 bytes
First seen:2020-05-14 06:45:51 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:wHbX4eRiZxweFLDH7EkFl4ZQsMLgt1MA4v:6Ri8QkkF8QLThv
TLSH BD942396772F19F5B018726D5D56627FA4F39A30D10E75283B0EF2CAB9AEBCD20042C4
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: se6e-iad1.servconfig.com
Sending IP: 173.231.241.27
From: Wang Tan <sales@whitelawtooling.com.au>
Subject: New Order Inquiry-2020513
Attachment: New Order Inquiry-2020513.pdf.gz (contains "New Order Inquiry-2020513.pdf.exe")

AgentTesla SMTP exfil server:
mail.oilexindia.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 07:36:51 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pipndusofrv363qwjx3gacoaxfagdy5qftmt43n3jswbevsa7k6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 7a1ed1d24e2c6bbf6e164df66009c0b94061e3b02cd93e6dbb4cac125640fabc

(this sample)

AgentTesla

Executable exe bb0af56a4f5031be7eada30581e3c5ee3a53032de01c03281e393b950a28fc0c

  
Dropping
MD5 56396038d79d42bbe2e4d7d429ddddfa
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bb0af56a4f5031be7eada30581e3c5ee3a53032de01c03281e393b950a28fc0c

Comments