MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 044e33038e6d5093a1ee9711fbb5f29010c4c4ef807517a7e137353f5a5c7817. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 044e33038e6d5093a1ee9711fbb5f29010c4c4ef807517a7e137353f5a5c7817
SHA3-384 hash: bc31557ffda1f81d7eaef18c6efb2e592379ba7b27a0c86434a248138a93a50ba67bcd9f06158bac21472a553c16a1d1
SHA1 hash: 15522da6cb731dd180c1556fa3e3e8f47008031e
MD5 hash: 283cc34afa0a3d63cfdca96196635c89
humanhash: harry-uncle-robert-quebec
File name:REQUEST UPDATED BUSINESS DETAILS_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:398'042 bytes
First seen:2020-05-19 14:27:59 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:SnjK/aje8HA4QQQlO9vINIQrRrs/se49dMgvKVzjpJdt7ArwqMWMpYR13FgdRVbh:SnjRLj9vcIqeb6M6eL2++gdzwmrNs7Z0
TLSH 6084231AD294737E38BA745E13A8095CFE2FCD0C912E4148BC9BE9E23859150D5FC67E
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lif.lifecare.com.my
Sending IP: 198.20.247.243
From: Sales & Marketing Department <asialiftsale@nichiyuph.com>
Subject: REQUEST UPDATED BUSINESS PERMIT
Attachment: REQUEST UPDATED BUSINESS DETAILS_pdf.gz (contains "gunzipped")

AgentTesla SMTP exfil server:
smtp.anding-tw.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27383.GZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 14:36:50 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=arhdga4onvijhipos4i7xnpssaimjrhpqb2rpj7bg42t6ws4palq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 044e33038e6d5093a1ee9711fbb5f29010c4c4ef807517a7e137353f5a5c7817

(this sample)

AgentTesla

Executable exe 4c3d7e5ee1bbc1c9287795b32125883a0cd235ddce5ede3a5362056bcc586963

  
Dropping
MD5 8c0040da9da19ebd93ba50e378a90ab9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4c3d7e5ee1bbc1c9287795b32125883a0cd235ddce5ede3a5362056bcc586963

Comments