MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09a31b96e645522f97f5fdff26af6bf3cbb228810541cd6544a7750245288b37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 09a31b96e645522f97f5fdff26af6bf3cbb228810541cd6544a7750245288b37
SHA3-384 hash: a093d7e4d90e187ed820f319207302481de54bf3e0ce53c041316907a4a44ebd49963683244d5feefabcfee7f9c12469
SHA1 hash: f55b3c3ff26e8bf688eb83f9c97920afff28bea7
MD5 hash: 089b62bc34199d7abd0deb3ee988e5d7
humanhash: wolfram-kilo-eighteen-finch
File name:Fatura-000900.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:475'860 bytes
First seen:2020-05-07 11:04:20 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:c40i15/hW0s6qK3H8+3E8PJAXV0BJXNoctLSAgm:7Z/IRzAHZ3E8PJAlSJXNBdSa
TLSH 5CA4239E4D16F20649BF1F8A9421CE944B590E860A07745E23F9CCDB7C8F3D72A21CE2
Reporter abuse_ch
Tags:AgentTesla geo TUR z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.elmasgrafik.com
Sending IP: 185.48.182.122
From: Maktek <satinalma@maktek.com.tr>
Reply-To: satinalma@maktek.com.tr
Subject: Fatura ödemesi
Attachment: Fatura-000900.Z (contains "Fatura-000900.exe")

AgentTesla SMTP exfil server:
smtp.ionos.mx:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VUF.19958.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 11:35:41 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bgrrxfxgivjc7f7v7x7snl3l6pf3ekebava42zkeu52qerjirm3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 09a31b96e645522f97f5fdff26af6bf3cbb228810541cd6544a7750245288b37

(this sample)

AgentTesla

Executable exe ff3a44650dfcba5ccfa616d1311580e6e4f11eddabacf0758ed9a71f10c49bf4

  
Dropping
MD5 38ce9124ac9e7b59516b05ae89b38597
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ff3a44650dfcba5ccfa616d1311580e6e4f11eddabacf0758ed9a71f10c49bf4

Comments