MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a2716ea2c888050046c873bbba829cfa2a27d312d9eb545ef8dcf4c64b90155. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a2716ea2c888050046c873bbba829cfa2a27d312d9eb545ef8dcf4c64b90155
SHA3-384 hash: 3750d8d83ea99239de42ae151f1ec87aa2075af2289d8fa6f028e0468a3b2c1d8cfc6fe920e2f7f6d2d5d6d155656f21
SHA1 hash: 9b6905498102dbb531a0126868d78447d0ea78ac
MD5 hash: 00b79204c5e7442e998ad148197a1803
humanhash: stream-carolina-avocado-item
File name:ThyssenKrupp AG Supplier Vendor Registration.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:713'657 bytes
First seen:2020-12-28 17:35:15 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:1kXbm+SOOMXjWY0l9v4UEaJu1CV1UVtuKMvkxMF:14mFFMXjal9vfJ2QghMcyF
TLSH 72E4338F61928EF450A34EEB3D0F12A110B1607C251CD5FB2F2558FE3ED5B0C69AE56A
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box1.spuredge.com
Sending IP: 79.124.78.164
From: Frank Herrmann - ThyssenKrupp AG <info@spuredge.com>
Reply-To: Frank Herrmann - ThyssenKrupp AG <info@spuredge.com>
Subject: Fw: Supplier/Vendor Registration
Attachment: ThyssenKrupp AG Supplier Vendor Registration.zip (contains "ThyssenKrupp AG Supplier Vendor Registration.exe")

AgentTesla SMTP exfil server:
smtp.nirmalindustreis.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
389
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisTrojan.27049.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a2716ea2c888050046c873bbba829cfa2a27d312d9eb545ef8dcf4c64b90155/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-12-28 17:36:06 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pitrn2rmrcafabdmq453xkbjz6rke7jrfwplkrpprxhuyzfzafkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.97
Link:
https://yomi.yoroi.company/submissions/7a2716ea2c888050046c873bbba829cfa2a27d312d9eb545ef8dcf4c64b90155

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7a2716ea2c888050046c873bbba829cfa2a27d312d9eb545ef8dcf4c64b90155

(this sample)

AgentTesla

Executable exe fbb40fa362f6713f62d6ba9f5c0e05b056c7240de1f23206809e5da556fc7ce5

  
Dropping
MD5 813ba7b72128180fa55bfe68ac31a667
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fbb40fa362f6713f62d6ba9f5c0e05b056c7240de1f23206809e5da556fc7ce5

Comments