MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7aaf8ab0d3604a2e4e7f4de1ff2eda72256512ba34af1d6b7c5d3b8cbcfd51a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7aaf8ab0d3604a2e4e7f4de1ff2eda72256512ba34af1d6b7c5d3b8cbcfd51a3
SHA3-384 hash: f5e030059cedc2aba6697aa91b17f0cb09340f1b315b9f938361f8f2900bf9601fff42d6413dcd750663a0d890407957
SHA1 hash: 209e1cf13663fa2d19b8956e8b806945b051e2f1
MD5 hash: 94505ac7ddd967679e19a512690ad859
humanhash: east-two-angel-charlie
File name:Proforma Invoice.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:395'171 bytes
First seen:2020-05-13 09:38:03 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:E4l5oGDGSDzp1DHfitp7pbjU1b3qwJAFEc2:J5oORHDHfitDjabgFEP
TLSH 698423B8A8F0A56E97352E0BC44753D0AAE915E36F5FD19358EF5C42AA05FDD08C80E3
Reporter cocaman
Tags:AgentTesla cab


Avatar
cocaman
Malicious email
From: Anne Shui<zhkj@vip.163.com>
Received: from vip.163.com (unknown [45.137.22.40])
Date: 13 May 2020 02:20:58 -0700
Subject: RE: INVOICE
Attachment: Proforma Invoice.cab

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 09:19:14 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pkxyvmgtmbfc4tt7jxq76lw2oiswkev2gsxr2234lu5yzph5kgrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 7aaf8ab0d3604a2e4e7f4de1ff2eda72256512ba34af1d6b7c5d3b8cbcfd51a3

(this sample)

AgentTesla

Executable exe 7a1cf26ab248a5fa19ed5df571e20fe4c85c2f304a0258311b07309775013d33

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7a1cf26ab248a5fa19ed5df571e20fe4c85c2f304a0258311b07309775013d33

Comments