MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7f445d296018dd8177d8c9fa8a455106f32c03afc275956b96c309c3b4f31ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f7f445d296018dd8177d8c9fa8a455106f32c03afc275956b96c309c3b4f31ba
SHA3-384 hash: 741f77e3d006e91cee6838ff2b4c52cf098bdda969be509af7850825d3da75a8f91009fecd9e4fc4fa487ff52b26fc2b
SHA1 hash: a5c1cca9a4ae62f2e1ae905ee43fef4d066c8450
MD5 hash: 958865ab1cb8ada0d8741d2cdf27ecf7
humanhash: green-december-kitten-massachusetts
File name:TT Copy_pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'769'472 bytes
First seen:2021-01-08 08:23:40 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:GuvNHl8QQBodWY9coYGfoc6Ozo0fmnm5jlJjg3/OLNmKO10na:blHmPBYeXGfoc5zpmnuhpYcNmV
TLSH 1785CEC0FEA7E644D0291AF1C99DC11DAAA1EF0C5756CC3A6A89F348067260CCDF96F5
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: host.gfg.com.pk
Sending IP: 116.71.128.142
From: Account Department <rafi.ullah@gfg.com.pk>
Subject: Confirmation Of Invoice And Bank Details( All Due outstanding payments 2020)
Attachment: TT Copy_pdf.img (contains "TT Copy_pdf.scr")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.16166.25945.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f7f445d296018dd8177d8c9fa8a455106f32c03afc275956b96c309c3b4f31ba/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-08 04:00:32 UTC
AV detection:
4 of 46 (8.70%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=672eluuwagg5qf35rsp2rjcvcbxtfqb27qtvsvvznqyjyo2pgg5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f7f445d296018dd8177d8c9fa8a455106f32c03afc275956b96c309c3b4f31ba

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img f7f445d296018dd8177d8c9fa8a455106f32c03afc275956b96c309c3b4f31ba

(this sample)

AgentTesla

Executable exe 0858182cc5f6f5a3c7b96f90c5ea266c4ef22effd00ef54b0a72308ff11e932e

  
Dropping
MD5 77d80e55696f7e3f470a0549dd4f8479
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0858182cc5f6f5a3c7b96f90c5ea266c4ef22effd00ef54b0a72308ff11e932e

Comments