MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e775d30df7e9b318f8657a4bd251c01c38f0a7e3867f082d4d4ab3b2935f7858. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e775d30df7e9b318f8657a4bd251c01c38f0a7e3867f082d4d4ab3b2935f7858
SHA3-384 hash: 462d9dcd4901cb687a0b5083a37e28d504534509f5084db5bb6d48148c7da8f7a7a4474460d87bad49ab478a7cc68ea4
SHA1 hash: cd3d444e33ebe69ec284cabb29d085b973d812b1
MD5 hash: 379663ad4df3ade52a87323c83dc1d6d
humanhash: wolfram-whiskey-friend-vegan
File name:CNC 39200-pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:605'469 bytes
First seen:2020-10-14 16:35:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:BoEsYa4Ep01d2jQg6azdkUReaiYf6kFTMdI61Hu6WDlsL+:BoP1pId284Rea7TMdz1O6WRh
TLSH 68D423BA879F9903943FD09B3CDE2EC067D70D2682442899272C25FC974D47C99FA94B
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: fnadk-36.srv.cat
Sending IP: 46.16.62.46
From: Info TTY (Nuevo) <info@taxtrophy.com>
Reply-To: Info TTY (Nuevo) <baeutyslondon@yahoo.com>
Subject: CNC 39200 // ANÁLISIS DE CONTRATO
Attachment: CNC 39200-pdf.7z (contains "CNC 39200-pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e775d30df7e9b318f8657a4bd251c01c38f0a7e3867f082d4d4ab3b2935f7858/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 15:03:12 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4525gdpx5gzrr6dfpjf5euoadq4pbj7dqz7qqlknjkz3fe27pbma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/e775d30df7e9b318f8657a4bd251c01c38f0a7e3867f082d4d4ab3b2935f7858

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e775d30df7e9b318f8657a4bd251c01c38f0a7e3867f082d4d4ab3b2935f7858

(this sample)

AgentTesla

Executable exe d9ef6dd0ddbe95b3f858ec1e3cb40d5493c89f8844227f2c31739a9e7cef7ab9

  
Dropping
MD5 63fd7ddf82fa470150fc1362112e0eb1
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d9ef6dd0ddbe95b3f858ec1e3cb40d5493c89f8844227f2c31739a9e7cef7ab9

Comments