MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a5a4000884d5bb968664e2b0de5f5d7f0c97fd393c29f2e91f80daa74552348. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a5a4000884d5bb968664e2b0de5f5d7f0c97fd393c29f2e91f80daa74552348
SHA3-384 hash: 5b4eb121ddaaeed27fc97f011ac0055ceb4e8f8c723770880efe738ae13398e24f2e762624be59e8867820d1bb6ed933
SHA1 hash: 10f7ff2966098fcfffd3daabc8ece3f65b0da71c
MD5 hash: 430387ece30950651b848cd8db4feb1f
humanhash: five-october-lake-mars
File name:Data sheet.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:436'440 bytes
First seen:2021-02-24 07:03:15 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:KODr6Iw60jJW3SrcvlhFB3UfnYxsfl8lYqHTbKx:Nrhw60SSrc9tEwxs+lpHfKx
TLSH A89423806289664C7EFEB23DB6F4872E5D9CEEC29347F51AC4B12E8535D22312CE61D4
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: df0.319.xvonq.ml
Sending IP: 139.59.174.192
From: Bharti Singh <sales@319.xvonq.ml>
Subject: New order Inquiry #SW00210020
Attachment: Data sheet.pdf.zip (contains "Data sheet.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a5a4000884d5bb968664e2b0de5f5d7f0c97fd393c29f2e91f80daa74552348/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 04:00:22 UTC
AV detection:
14 of 47 (29.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pjneaaeijvn3s2dgjyvq3zpv27yms76tspbj6lur7ag2u5cvenea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7a5a4000884d5bb968664e2b0de5f5d7f0c97fd393c29f2e91f80daa74552348

(this sample)

AgentTesla

Executable exe 30872c755e58b1ee3bb273e169b0b965939575af5c3e4626f53622e0f0705cad

  
Dropping
MD5 7fdae8d5db4b64f7c4b6b684819f85f9
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 30872c755e58b1ee3bb273e169b0b965939575af5c3e4626f53622e0f0705cad

Comments