MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b888494d9279f87b3b2a69e11fa5a68efa06bc86522d02764382da220396861. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 3 Yara 3 Comments

SHA256 hash: 7b888494d9279f87b3b2a69e11fa5a68efa06bc86522d02764382da220396861
SHA3-384 hash: bf0fd0996a5a3556063d1c9d266936cb7dbd179ea4f3c53978b989b8d0d0aeb549edf91bc65e77c4ebab016edcbd0069
SHA1 hash: a921eba7d983bcb181d0bb224c91ef64769021e7
MD5 hash: 1526bf783e32b08409639b9cefb0ff08
humanhash: angel-timing-helium-seventeen
File name:Invoice_33748.exe
Download: download sample
Signature AgentTesla
File size:422'912 bytes
First seen:2020-06-30 13:23:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep 12288:uzkKJIsNdQ5W1nkx9C7b1GDeS4maYCTU8E:uzkKJGW1kDC7xwFaFo
TLSH D0940270B3695B36DDB9CBFB61A164110FBA3C1B3930C61C6C80B1CA2A677459764F2B
Reporter @abuse_ch
Tags:AgentTesla exe


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: alkuhaimi.com
Sending IP: 209.58.149.66
From: Sales <rud-division@alkuhaimi.com>
Subject: Proforma Invoice
Attachment: Invoice_33748-pdf.r00 (contains "Invoice_33748.exe")

AgentTesla SMTP exfil server:
webmail.uteshiyamedicare.com:587

AgentTesla SMTP exfil email address:
info@uteshiyamedicare.com

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 31
Origin country FR FR
CAPE Sandbox Detection:n/a
Link: https://www.capesandbox.com/analysis/17215/
ClamAV SecuriteInfo.com.Generic-EXE.UNOFFICIAL
CERT.PL MWDB Detection:agenttesla
Link: https://mwdb.cert.pl/sample/7b888494d9279f87b3b2a69e11fa5a68efa06bc86522d02764382da220396861/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 13:25:04 UTC
AV detection:22 of 31 (70.97%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:agenttesla
Link: https://tria.ge/reports/200630-5raftfggp2/
Tags:spyware keylogger trojan stealer family:agenttesla
VirusTotal:Virustotal results 17.81%

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

8c5ebe46341ac60304d1e1a6da3e6497

AgentTesla

Executable exe 7b888494d9279f87b3b2a69e11fa5a68efa06bc86522d02764382da220396861

(this sample)

  
Dropped by
MD5 8c5ebe46341ac60304d1e1a6da3e6497
  
Delivery method
Distributed via e-mail attachment

Comments