MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7de0bdd809f457da6f24445bad468e691748139554e0ed29f10985cbb6de624. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a7de0bdd809f457da6f24445bad468e691748139554e0ed29f10985cbb6de624
SHA3-384 hash: c1c358c9994072bd9fc3736bc856d1329435e0dc61586d6080a89116b0c8450f5446bc74e235a1a84bde2618efc9c04e
SHA1 hash: fd65e570011b3673c0a722a383211ec0fe6442ba
MD5 hash: 92c3f6d78a6abb0f1fb365649f35b2a2
humanhash: mexico-quebec-nevada-hotel
File name:Order_List_PO# 081928.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:584'343 bytes
First seen:2020-10-08 16:28:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:4B27xLIg8zwf0wFJ1Usu2sUIXn2QTchAF045RElw1g4Ed+OtvUxM:4AtLIgh8wtfwTg0mlegLyq
TLSH 61C4232A0E03BB6245E5C0DA994D207E5B737E8460394C92677C4E862BCDF754B788AF
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Sales<sales@gommcp.com>"
Received: "from gommcp.com (unknown [95.211.230.53]) "
Date: "08 Oct 2020 08:43:28 -0700"
Subject: "Order List (PO# 081928)"
Attachment: "Order_List_PO# 081928.pdf.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a7de0bdd809f457da6f24445bad468e691748139554e0ed29f10985cbb6de624/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 15:38:36 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u7paxxmat5cx3jxsirc3vvdi42ixjajzkvha5uu7ccmfzo3n4ysa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a7de0bdd809f457da6f24445bad468e691748139554e0ed29f10985cbb6de624

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a7de0bdd809f457da6f24445bad468e691748139554e0ed29f10985cbb6de624

(this sample)

AgentTesla

Executable exe 2f02f87bd00996719cd97c827f1bd4578033a03d7e3884ec18ec0eca32cee516

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2f02f87bd00996719cd97c827f1bd4578033a03d7e3884ec18ec0eca32cee516
  
Dropping
AgentTesla

Comments