MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e4211e7d56e60f01db9e3eb0a36f6eb1d7b0f2ab6272701dca3e39c8a490e24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e4211e7d56e60f01db9e3eb0a36f6eb1d7b0f2ab6272701dca3e39c8a490e24
SHA3-384 hash: bcbb5691b38c97d5c2c1877fced0fbff0114f70c819d1f032d8aa7a12044feb68f7d213f102c6568292969172006a74d
SHA1 hash: af62071fb1b8c4b4924bff4aa6f946323345d179
MD5 hash: 251108a6f50f0643365216332e0fdf99
humanhash: triple-mississippi-white-utah
File name:PO. FSTG-2005007 DOCS_PDF.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-30 08:07:55 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:Tot4ugbrJ9gbK9sKoBlVmKCpGQI2cThd:kqrDG6sBVmK6GQI2cf
TLSH FE45D1293284BF5EC26E4D3684550900E7F0EDB71703E78B7CD63ADC6F6E2596E22192
Reporter abuse_ch
Tags:AgentTesla img SendGrid


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: wrqvzrvn.outbound-mail.sendgrid.net
Sending IP: 149.72.229.130
From: Da-Hae <tkuntelia@usa2georgia.com>
Subject: PO. FSTG-20200017
Attachment: PO. FSTG-2005007 DOCS_PDF.img (contains "PO. FSTG-2005007 DOCS_PDF.exe")

AgentTesla SMTP exfil server:
smtp.urban.co.th:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7e4211e7d56e60f01db9e3eb0a36f6eb1d7b0f2ab6272701dca3e39c8a490e24/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 08:09:07 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pzbbdz6vnzqpahnz4pvqunxw5moxwdzkwytsoao4uprzzcsjbysa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.91
Link:
https://yomi.yoroi.company/submissions/7e4211e7d56e60f01db9e3eb0a36f6eb1d7b0f2ab6272701dca3e39c8a490e24

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 7e4211e7d56e60f01db9e3eb0a36f6eb1d7b0f2ab6272701dca3e39c8a490e24

(this sample)

AgentTesla

Executable exe 23435f105ddf404a326b4a18d051d76dd91ea1f8079675dc642c87363e12eab4

  
Dropping
MD5 26d0ef6adee0aeaae646ba6ba41b2e0b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 23435f105ddf404a326b4a18d051d76dd91ea1f8079675dc642c87363e12eab4

Comments