MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a81ac215b10729969043750a795faf7dd186afb3560b1c0b0e4df18e9a2d635. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a81ac215b10729969043750a795faf7dd186afb3560b1c0b0e4df18e9a2d635
SHA3-384 hash: 21da9f558866ee7ee9c133dc9cefdc3072fa4501d5c4732b144c8f375954c9b51ac985c2bd4e8b5b6348e60811dd7b47
SHA1 hash: 2902b6fa1a8e61f3242f198e97e8cea73baca44c
MD5 hash: 2e350655203f90e24d766e77a030c10c
humanhash: summer-double-kentucky-eight
File name:Cotización.r00
Download: download sample
Signature AgentTesla
Create hunting rule
File size:742'401 bytes
First seen:2020-10-10 06:54:08 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:wahIQklR50htw2M88UpVNPkpaerAmwupDoVzHqchAAm0grJUL/fLF4Je0713C7qk:waGBb2htw2MXUxPcaer1YKcqvJ+p2e0M
TLSH 77F43349A6358091A879634B7DF52621BFD606DD4E075290C7F73CE88F8213EE113BAB
Reporter abuse_ch
Tags:AgentTesla r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: outmx-267.london.gridhost.co.uk
Sending IP: 31.170.120.152
From: Comunicado <comunicado@sys-prontius.com>
Reply-To: Comunicado <Ventas@imagencolor.cl>
Subject: Re: Cotización
Attachment: Cotización.r00 (contains "Cotización.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a81ac215b10729969043750a795faf7dd186afb3560b1c0b0e4df18e9a2d635/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 23:45:53 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pka2yik3cbzjs2ieg5ikpfp267orq2x3gvqldqfq4tprr2nc2y2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7a81ac215b10729969043750a795faf7dd186afb3560b1c0b0e4df18e9a2d635

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r00 7a81ac215b10729969043750a795faf7dd186afb3560b1c0b0e4df18e9a2d635

(this sample)

AgentTesla

Executable exe 782784b7a36998823584c4967ce23c48f66f8a0716755f8b4ba8edcca793a185

  
Dropping
MD5 2a5b1193eb4cbda768e150c94e666195
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 782784b7a36998823584c4967ce23c48f66f8a0716755f8b4ba8edcca793a185

Comments