MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7db5974f16db1242a0212877eaf417100c33251811963573ac3eff2b4864fd6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7db5974f16db1242a0212877eaf417100c33251811963573ac3eff2b4864fd6f
SHA3-384 hash: 86e15d28919355174f95416d89b50218cc58cec3488b6e59da585d9a7b7b2abf3280bce379d1116ae8f0fe6e3fa084a8
SHA1 hash: 0040475885bb35c31aa9430c307e6369e0636061
MD5 hash: 06e441f7f93dafd9c3425532db0161fb
humanhash: mississippi-sink-seventeen-wisconsin
File name:purchase order.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:463'340 bytes
First seen:2020-09-16 08:37:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:AcfdLAuFDEiGXSH20+PRYI3tlO5Fmw6G2ztsWiMjWz:AAAuFIiGCHsPSIdKF5A6WiMU
TLSH D7A423D01090A935E6EDC27E2A4EB511AD7D5C70D7387B58066B6E66C2ECBB053C30FA
Reporter cocaman
Tags:AgentTesla rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Per Hansson <per@pmhansson.com"
Received: "from pmhansson.com (unknown [103.151.124.245]) "
Date: "16 Sep 2020 01:36:09 -0700"
Subject: "Re: purchase order"
Attachment: "purchase order.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7db5974f16db1242a0212877eaf417100c33251811963573ac3eff2b4864fd6f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-09-16 08:39:04 UTC
File Type:
Binary (Archive)
Extracted files:
43
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pw2zotyw3mjefibbfb36v5axcagdgjiycgldk45mh37swsde7vxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7db5974f16db1242a0212877eaf417100c33251811963573ac3eff2b4864fd6f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 7db5974f16db1242a0212877eaf417100c33251811963573ac3eff2b4864fd6f

(this sample)

AgentTesla

Executable exe f458911cad980b38b8c73ec5b8755b9b5d0d1ff6906ed78da4d5f6ec79b5acf8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f458911cad980b38b8c73ec5b8755b9b5d0d1ff6906ed78da4d5f6ec79b5acf8
  
Dropping
AgentTesla

Comments