MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7b97130b3450ae3d643293c19d5bb5c99e4040109b0d2aafa1bf6a167a4a7af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7b97130b3450ae3d643293c19d5bb5c99e4040109b0d2aafa1bf6a167a4a7af
SHA3-384 hash: d1aedbd1830a508d16c7f0e5ecacb26586371a350504586930b381de7fc679a56157a1cca426d7327cfdb86a1c504607
SHA1 hash: 1be5417f95fb859afd640385f5d5d733be617577
MD5 hash: af237862175551d656cb6e558487aff2
humanhash: ack-papa-river-louisiana
File name:Payment Advice DOC 03222021_PDDF.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:539'402 bytes
First seen:2021-03-22 07:28:32 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:ycAmYDXakVOEDrkGZ2ba/6MPK/YUcSvONdIz0M:yT3TxsEzYbalUYU1eA0M
TLSH 6BB423B36ADEFF51C2C60C6750C75323FBDD48924A4340E856F90782B5BA91F94B61CA
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ir.netease.com
Sending IP: 31.210.20.196
From: Erkhembileg Tumurkhuyag <noreply@ir.netease.com>
Subject: Payment Advice
Attachment: Payment Advice DOC 03222021_PDDF.gz (contains "Payment Advice DOC 03222021_PDDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7b97130b3450ae3d643293c19d5bb5c99e4040109b0d2aafa1bf6a167a4a7af/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-22 03:45:47 UTC
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=464xcmftiufohvsdfe6btvn3lsm6ibabbgynfkx2dp3kcz5eu6xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e7b97130b3450ae3d643293c19d5bb5c99e4040109b0d2aafa1bf6a167a4a7af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz e7b97130b3450ae3d643293c19d5bb5c99e4040109b0d2aafa1bf6a167a4a7af

(this sample)

AgentTesla

Executable exe 02a69fc935a85ac7d81899516e6eb368cc9a2d32ef2fe49f17b5e8d531fe9fe8

  
Dropping
MD5 7470bbb2c941ab599e76e11a7c6f62a2
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 02a69fc935a85ac7d81899516e6eb368cc9a2d32ef2fe49f17b5e8d531fe9fe8

Comments