MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0450e4c5ccd43c9a2ac068fe96912c41ff6fa6833b879b5f1e4bb004e763be4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0450e4c5ccd43c9a2ac068fe96912c41ff6fa6833b879b5f1e4bb004e763be4e
SHA3-384 hash: fe598d7cc7593e3157b526f117361c1da8d2cf95c47ac8327e8002fedc99d4bc3adcd5728e5a25d1fc8e0f8949707115
SHA1 hash: 989f87bb301330e4b56d7483bea55b1f7c67e5bf
MD5 hash: 99b347427b4b6f54c86382c91e163e09
humanhash: snake-black-sodium-muppet
File name:Confirmed_Product_List_780972020_pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:490'629 bytes
First seen:2020-07-29 05:25:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:wo2tmsn6vZ3dZB0H83VyErOCrku3nJFnyXtFuUbIK:9Ymsn6BtR3QESCrk+JVKPB
TLSH DDA423BEE95B8191381F36B0601EE08B1091189DEB787E4B3F71A8F9B1CF69E561D740
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gmail.com
Sending IP: 104.168.237.10
From: Catherina Richie <evelina@aktmakine.com>
Reply-To: chrisisloaded@mail.com
Subject: Confirmed Product List
Attachment: Confirmed_Product_List_780972020_pdf.zip (contains "Confirmed_Product_List_780972020_pdf.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0450e4c5ccd43c9a2ac068fe96912c41ff6fa6833b879b5f1e4bb004e763be4e/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 05:27:04 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ariojrom2q6jukwand7jnejmih7w7judhodzwxy6joyajz3dxzha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/0450e4c5ccd43c9a2ac068fe96912c41ff6fa6833b879b5f1e4bb004e763be4e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0450e4c5ccd43c9a2ac068fe96912c41ff6fa6833b879b5f1e4bb004e763be4e

(this sample)

AgentTesla

Executable exe 139c390b2e3355e7162b92d4d8109871c8f023b888ccbe1d43ba8dc50c0b6d39

  
Dropping
MD5 9460d1f216309716955c8572763db8e4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 139c390b2e3355e7162b92d4d8109871c8f023b888ccbe1d43ba8dc50c0b6d39

Comments