MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0058a4dd2162072100eb252e7d1e7d91680a3ea7969a6aed5a2f9e03061d474b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0058a4dd2162072100eb252e7d1e7d91680a3ea7969a6aed5a2f9e03061d474b
SHA3-384 hash: 16ff4ef1887b6d154831986ff615a2d0f74393f239da0701ea4e77648efc2d7f762c000156360f3ef0cdbcfc77d78896
SHA1 hash: 2f07a83a53c624237a92f96f7b03840d32d678f7
MD5 hash: 41ebefc487c025349da0223c568c552f
humanhash: fillet-kansas-kentucky-zulu
File name:FPL-20192070152100.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:635'477 bytes
First seen:2020-07-20 07:54:45 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:+U7jmYH4ieQd3rEI17a1tF7FBryw4G5q0+9GaNBexVbLr6uc2Rm:+JYYivRrEIEP4U1OZIBL+ucsm
TLSH F2D42325F9908DF76327F865C16099A50237DF8C6CD2035F29F3A905522CDABE4822AE
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server0.natlna.com
Sending IP: 192.236.192.139
From: purchase <sales@natlna.com>
Subject: Kindly confirm documents
Attachment: FPL-20192070152100.z (contains "FPL-20192070152100.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0058a4dd2162072100eb252e7d1e7d91680a3ea7969a6aed5a2f9e03061d474b/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 07:56:06 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=abmkjxjbmidscahleuxh2ht5sfuaupvhs2ngv3k2f6pagbq5i5fq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0058a4dd2162072100eb252e7d1e7d91680a3ea7969a6aed5a2f9e03061d474b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 0058a4dd2162072100eb252e7d1e7d91680a3ea7969a6aed5a2f9e03061d474b

(this sample)

AgentTesla

Executable exe e699b803c7f94c7d211707e0869f7a07dddda3f383750c2b8ce5d4d16daf7178

  
Dropping
MD5 9954304cb154eab5015f13929c2c8d91
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e699b803c7f94c7d211707e0869f7a07dddda3f383750c2b8ce5d4d16daf7178

Comments