MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7b583c2ad1d30c59b3819ab9b70feb890e2acd75b0e3deee653987ef7ccde4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7b583c2ad1d30c59b3819ab9b70feb890e2acd75b0e3deee653987ef7ccde4d
SHA3-384 hash: 63212de5703cf316ca4e8e1c1a952249c8d80dbf6d3d67cf982d2874b92aff65bacd127ca884d5b5d0512fc1f6fe9b56
SHA1 hash: 27f093fe6cd492a1da056727674779e35eb59381
MD5 hash: 4f90bd05b57c486425580414b72f2847
humanhash: iowa-romeo-mobile-xray
File name:SIT-10295.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:33'300 bytes
First seen:2021-01-27 06:21:42 UTC
Last seen:2021-01-27 14:41:40 UTC
File type: gz
MIME type:application/x-rar
ssdeep 768:DqyjyVKRo7T2jq37nVMeSem7sRnJF2bE0DYfc8:O67ehVMlea+2bE0DYfc8
TLSH CDE2F10AD931E37DFE4184219F1B3109FB9EDC096A92A0857CD9E7AEB0C5005D5ECA9F
Reporter cocaman
Tags:gz


Avatar
cocaman
Malicious email (T1566.001)
From: ""Mr. Jason" <motsoa@dinamic.xyz>" (likely spoofed)
Received: "from hd0.113.skjo.ga (hd0.113.skjo.ga [167.172.239.32]) "
Date: "Tue, 26 Jan 2021 20:27:09 -0800"
Subject: "RFQ: SIT-10295"
Attachment: "SIT-10295.gz"

Intelligence

File Origin
# of uploads :
4
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7b583c2ad1d30c59b3819ab9b70feb890e2acd75b0e3deee653987ef7ccde4d/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=262yhqvnduymlgzydgvzw4h6xcioflgxlmhd33xgkomh556m3zgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d7b583c2ad1d30c59b3819ab9b70feb890e2acd75b0e3deee653987ef7ccde4d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz d7b583c2ad1d30c59b3819ab9b70feb890e2acd75b0e3deee653987ef7ccde4d

(this sample)

AgentTesla

Executable exe cdd026138671e26fdeaa513f4ee4df1b14162219fcd4e0d40ea50d7b122495b7

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cdd026138671e26fdeaa513f4ee4df1b14162219fcd4e0d40ea50d7b122495b7

Comments