MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7cdb92c17429c3e285941adb969f65f6265ccbb866ce6dac0087a15b2d094f20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7cdb92c17429c3e285941adb969f65f6265ccbb866ce6dac0087a15b2d094f20
SHA3-384 hash: 9ebd9ce82ccc8ca37aa80e1145da2e2c234a96195c36c861aa12cdc2309c5d7450b1dfcd036daac4cbc0d0009e286ab2
SHA1 hash: 0dcda77e9fc2584212358102b838ffc13a8adaf9
MD5 hash: 10996ac0cdd63b3c4f3f064220cc7c5f
humanhash: mexico-florida-hydrogen-early
File name:offer sheet for international business enquiry - fill the file attached about your company.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:460'819 bytes
First seen:2021-02-08 08:31:23 UTC
Last seen:2021-02-08 09:07:36 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:RWYvdFEW96Ys94n99TO2Pdv65Vd9FxNfilvqB:RhBdfVJw39FzKlCB
TLSH 62A42344272D4690E8A31083D63E19A15D8FE6A173CFF96F611344DA7071BA09C6CFBE
Reporter lowmal3

Intelligence

File Origin
# of uploads :
4
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7cdb92c17429c3e285941adb969f65f6265ccbb866ce6dac0087a15b2d094f20/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-08 08:32:07 UTC
File Type:
Binary (Archive)
Extracted files:
29
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ptnzfqlufhb6fbmudlnznh3f6ytfzs5ym3hg3laaq6qvwlijj4qa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7cdb92c17429c3e285941adb969f65f6265ccbb866ce6dac0087a15b2d094f20

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 7cdb92c17429c3e285941adb969f65f6265ccbb866ce6dac0087a15b2d094f20

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments