MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7a9360069b5a45d57794fa85030ca31b7648785ec13226d965d3bc60bea524b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f7a9360069b5a45d57794fa85030ca31b7648785ec13226d965d3bc60bea524b
SHA3-384 hash: 8ebb42212979cf56fa58dda6ca3883c86e840aea9104fc2ea262f10436924faa462aa34f9804d29a9bdc2e970871e3a0
SHA1 hash: 475a317f14d4f7d50d18e1929d71140afa878501
MD5 hash: 6c2b6e8d7b414b91e12a7e6d4d796ff9
humanhash: fourteen-gee-idaho-solar
File name:New supplier Inquiry and PO 208203150_ DOC.uu
Download: download sample
Signature AgentTesla
Create hunting rule
File size:542'747 bytes
First seen:2020-08-31 09:16:13 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:8/pFbEHawC736GDue/YW9Wm6TDDrVTh+jvO6pUKuJZmax:83I6lqGfxWV7SK2OL
TLSH 04B423A0A3ADF9216267F7043052297F82941F8E1B70563CE27A33177F97056C9336BA
Reporter abuse_ch
Tags:AgentTesla uu


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp.aonbd.net
Sending IP: 117.58.240.41
From: Purchase Vertex Safety A.S <purchase.vertexsafety.com@protonmail.com>
Subject: Re: New Supplier Inquiry Vertex Instanbul 80MT/PO208202.
Attachment: New supplier Inquiry and PO 208203150_ DOC.uu (contains "New supplier Inquiry and PO 208203150_ DOC.exe")

AgentTesla SMTP exfil server:
smtp.marinedepot.pw:587

AgentTesla SMTP exfil email address:
lam@marinedepot.pw

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f7a9360069b5a45d57794fa85030ca31b7648785ec13226d965d3bc60bea524b/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=66utmadjwwsf2v3zj6ufamgkgg3wjb4f5qjse3mwlu54mc7kkjfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f7a9360069b5a45d57794fa85030ca31b7648785ec13226d965d3bc60bea524b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar f7a9360069b5a45d57794fa85030ca31b7648785ec13226d965d3bc60bea524b

(this sample)

AgentTesla

Executable exe 726e4468c86762527d6fd4ebd9ebd07516e00e58eacf31e572b9f6c463727249

  
Dropping
MD5 c9d35a3fd5c065d1c6e9674b41d4049b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 726e4468c86762527d6fd4ebd9ebd07516e00e58eacf31e572b9f6c463727249

Comments