MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a92b9766b5ffef52a6d3fc88d4a93b80ce15e3aab17d30f80aaa34992ed5499. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a92b9766b5ffef52a6d3fc88d4a93b80ce15e3aab17d30f80aaa34992ed5499
SHA3-384 hash: bc36c3564388b984bb56f0c76b14253a10805ecc2080bbf8aaf100310470d524974ad7abaea58ed5bfa74a0b7813b3af
SHA1 hash: ea2344ef9a015ffc0237d632bcfefd4f34beacbf
MD5 hash: cf60e881e52b211f68fc9d1640c4cc5b
humanhash: item-helium-utah-king
File name:SOA-FGHK.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:430'339 bytes
First seen:2020-05-12 06:35:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:rdiw5lwOsc5B/l2NSbVGfAhJ0BUDoIY4s74r0h2GOP:hz5lwOsc5BYsc5GVr0h2G+
TLSH 8C9423ED8FE3600517095B0727EACA78CB2427D9C7AF6E184DEDFDF55168221312A360
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dhl.com
Sending IP: 103.99.1.173
From: Asif Ali Ahmed (DHL BD) <Asif.Ali.Ahmed@dhl.com>
Subject: STATEMENT AS THE END OF SEPT
Attachment: SOA-FGHK.zip (contains "SOA-FGHK.exe")

AgentTesla SMTP exfil server:
mail.dianaglobalmandiri.com:587

AgentTesla SMTP exfil email address:
info@dianaglobalmandiri.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 07:35:39 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bkjls5tll77pkktnh7ei2sutxagocxr2vml5gd4avkrutexnksmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0a92b9766b5ffef52a6d3fc88d4a93b80ce15e3aab17d30f80aaa34992ed5499

(this sample)

AgentTesla

Executable exe c182a5ba64ded3e4722169971689a19c5bd5e573fbacaa05d68ce3f164b13a6c

  
Dropping
MD5 6a8bdf8a861da44bd056001d52f53065
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c182a5ba64ded3e4722169971689a19c5bd5e573fbacaa05d68ce3f164b13a6c

Comments