MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 807800ab71f12a7a3b4a3a5c145ced623f902472544ce12c4a475e5765ff4a99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 807800ab71f12a7a3b4a3a5c145ced623f902472544ce12c4a475e5765ff4a99
SHA3-384 hash: 7c3931c28e931875fba92805d828876b79022fdbd5fccc58c698c5bfae77c749940f33932088e01eea2439a43470694a
SHA1 hash: ffb80065566eb16fd36c21176529fef7376a6efe
MD5 hash: 1c4b142668088b592c2214cb5a9cbde8
humanhash: march-spaghetti-connecticut-fourteen
File name:09000000000000000000000.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:366'772 bytes
First seen:2020-05-07 18:34:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Jt0bS6VJPBGzc565V/5RlJrcZtV7z/lN6iWzXir2Yx2ruOdyvya/tID/sM:QbNVJNK5RlJoZtx/j6xzir2YUr1s7mD/
TLSH 8E7423423E81977E8B9C652B5D307BD4393012D38B8B96E02E3E1C466658DA4854FFEF
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.elmasgrafik.com
Sending IP: 185.48.182.122
From: Mocayco <ventas@mocayco.com.mx>
Reply-To: ventas@mocayco.com.mx
Subject: Pago de facturas
Attachment: 09000000000000000000000.z (contains "09000000000000000000000.exe")

AgentTesla SMTP exfil server:
smtp.ionos.es:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 18:35:29 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qb4abk3r6evhuo2khjobixhnmi7zajdskrgoclcki5pfozp7jkmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 807800ab71f12a7a3b4a3a5c145ced623f902472544ce12c4a475e5765ff4a99

(this sample)

AgentTesla

Executable exe 93f1fd2b51e5ebbf6660e3101fb808c9008cbbcaea8839551a4d8ff6ebced161

  
Dropping
MD5 7f67cb0ba007a2f68d1f48f0fcfee9b9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 93f1fd2b51e5ebbf6660e3101fb808c9008cbbcaea8839551a4d8ff6ebced161

Comments