MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ab2aef0e38056810d5e60cb8b2e1d8fe959b1abe885655a3779037262297912. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ab2aef0e38056810d5e60cb8b2e1d8fe959b1abe885655a3779037262297912
SHA3-384 hash: 3bab55dffcb4f19ab1831ede0d0bfb32dc22a2e7f84f44ed64218f26cc7bd2ce43c2ad0a0447dc4d2d7ea6ae7d1cd28e
SHA1 hash: 0d5148022d3235288bc6b02cfca357716dec4bf6
MD5 hash: a23e3fddfdfbdb823cccca58eebd9d5b
humanhash: carpet-south-wisconsin-carbon
File name:HSBCBankCopy_pdf.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'145 bytes
First seen:2020-07-24 13:34:02 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:bAgPSopUtq7ldO6EjrBIldFJekj4LJjR2xvpd8Qo6KnLCl50G0py9vnUx:bAget6dCj+jvj4LJjQzSCIulmGAy9vy
TLSH 158423E7798E8FD19AFAE48E1637272BC71A46CC24B5303C43A346D391BD0D15BA90D6
Reporter abuse_ch
Tags:AgentTesla HSBC rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: fax.local
Sending IP: 118.99.229.12
From: capoly <capoly@omantel.net.om>
Subject: Advice Ref:[GLV321850941] / Priority payment / Customer Ref:[LE93L@006190321]
Attachment: HSBCBankCopy_pdf.rar (contains "HSBCBankCopy_pdf.exe")

AgentTesla SMTP exfil server:
smtp.epaindemgroup.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ab2aef0e38056810d5e60cb8b2e1d8fe959b1abe885655a3779037262297912/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-24 13:35:06 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pkzk54hdqblicdk6mdfywlq5r7uvtmnl5ccwkwrxpebxeyrjpeja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/7ab2aef0e38056810d5e60cb8b2e1d8fe959b1abe885655a3779037262297912

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 7ab2aef0e38056810d5e60cb8b2e1d8fe959b1abe885655a3779037262297912

(this sample)

AgentTesla

Executable exe 9d786f3211a5c8a16256bbd0c92f184305f476261721c914cf5df33432dc26b1

  
Dropping
MD5 69fbe671dd8053a7df64febc84bcb6e5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9d786f3211a5c8a16256bbd0c92f184305f476261721c914cf5df33432dc26b1

Comments