MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0690460355704ff1a35f16f907ed3d4af190b150e8579e70984c0ee484ece8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a0690460355704ff1a35f16f907ed3d4af190b150e8579e70984c0ee484ece8c
SHA3-384 hash: 3b4b41f7aa76e42a2d4e97e6ac9cb596a0b3c072eccc90426ae36a67d67248f33f7e33b8a02d3688ea01fbbf366488c0
SHA1 hash: ca806be4311666eb42ed6cae1702c0cef0cd6eda
MD5 hash: f65099b3ee5e47b049a1191b54ec8508
humanhash: don-hamper-rugby-uniform
File name:PEDIDO4965832-pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:337'129 bytes
First seen:2020-08-13 14:32:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:UFEAY2TfYFaB0yWE7O5Pwi9Vq6w5XqXbxS+JLjs02kIA57Vhil:nAY2TQFaBhoSiC6pHw05bVVhil
TLSH D46423C677703CBD9935EE47A9C2AA008761925563AD24DBCF0788BFF0EF7324061659
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: linux1537.grserver.gr
Sending IP: 185.138.42.92
From: Penka Tzolova <p.tzolova@qualityintergroup.com>
Reply-To: Penka Tzolova <baeutyslondon@yahoo.com>
Subject: NUEVO PEDIDO (POR FAVOR COTIZAR)
Attachment: PEDIDO4965832-pdf.7z (contains "PEDIDO#4965832-pdf.exe")

AgentTesla FTP exfil server:
ftp.transdealer.cl:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a0690460355704ff1a35f16f907ed3d4af190b150e8579e70984c0ee484ece8c/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 14:34:06 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ubuqiybvk4cp6grv6fxza7wt2sxrscyvb2cxtzyjqtao4scoz2ga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a0690460355704ff1a35f16f907ed3d4af190b150e8579e70984c0ee484ece8c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a0690460355704ff1a35f16f907ed3d4af190b150e8579e70984c0ee484ece8c

(this sample)

AgentTesla

Executable exe d44272fe83f10383b50e8268ffe5f7f70e1c2b355363ccde038172f6a9eb5479

  
Dropping
MD5 cd53bb5a8efb8397089db59307b51406
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d44272fe83f10383b50e8268ffe5f7f70e1c2b355363ccde038172f6a9eb5479

Comments