MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b1160f54c8ac9a114f36894e58fc1df1b28f681f833fdcc0d0b8da6cd2bffc6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b1160f54c8ac9a114f36894e58fc1df1b28f681f833fdcc0d0b8da6cd2bffc6
SHA3-384 hash: 2e00588f61b727c032d3ea3958fd28c8a457c0bc6bc26eb028f74d9f1553f09b91716227b303b816e150c87b23ff816c
SHA1 hash: a909886223cf0820971541dfc54b0785f307a33b
MD5 hash: d4d2830397613184beeee2f2ac873c4d
humanhash: fruit-kansas-sad-west
File name:send the quotion please.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'710'015 bytes
First seen:2020-06-26 07:15:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:igoJRcK1ivK7ZSSyRBzBBxRqjkIS9+o6Jec8qCMvHqVh9ZdIoY:igLAEAZ9yRBn7IocHZClY
TLSH 828533FE266E6463C5698F7B5BD03F358AD3D402BF9C66017E8427228CB39A015868F5
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ghhaewae.com
Sending IP: 103.99.1.174
From: Ramanuz <ramanuz@ghhaewae.com>
Subject: Padding, Down & Scrim booking for Timberland Our#201-5139~5140 Supplier:Youngone
Attachment: send the quotion please.zip (contains "send the quotion please.exe")

AgentTesla SMTP exfil server:
mail.alaboor.com:587

AgentTesla SMTP exfil email address:
msaheen@alaboor.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.21253.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b1160f54c8ac9a114f36894e58fc1df1b28f681f833fdcc0d0b8da6cd2bffc6/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 07:17:05 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pmiwb5kmrle2cfhtnckold6b34nsr5ub7az73tanbog2ntjl77da._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 7b1160f54c8ac9a114f36894e58fc1df1b28f681f833fdcc0d0b8da6cd2bffc6

(this sample)

AgentTesla

Executable exe a6e82740a814f93bbe3eae71109f479775246fab0d979de438bd6c74a388800a

  
Dropping
MD5 3eb99b9ec815d3d96305fb8f905978ba
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a6e82740a814f93bbe3eae71109f479775246fab0d979de438bd6c74a388800a

Comments