MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 125ed180de54eb2ef0325da96c799c446d2d1df021e4e5a365a661e2d265a2c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 125ed180de54eb2ef0325da96c799c446d2d1df021e4e5a365a661e2d265a2c8
SHA3-384 hash: ede97688ce34c34ec2fed4e64179974d47a22ba022ffedb19f750755c229f98e6ed2d07d752970cc26c97f41e60cda9c
SHA1 hash: 9457ecf664ab71d9f841e1623d9bd53dd74525d7
MD5 hash: 43d354dc71fba84b80fb839ae493f8bc
humanhash: gee-xray-cup-nitrogen
File name:June_Request LTC40111EDD.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:445'546 bytes
First seen:2020-06-10 06:56:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Mk1bd0JDULzNrudqGwUtzfxtU3fT+rl/96J5:71bdmDUGNBpa3fCx47
TLSH 1994232B750375A2186217B0A88B7F924568547B3C3B95BFF8527B319E3934433AC336
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: c9.ns360.net
Sending IP: 210.184.155.176
From: Pacific Corp.Tokyo <alejandra@nagle.gq>
Subject: RE: New June shipment Order- request# LTC40111EDD
Attachment: June_Request LTC40111EDD.zip (contains "June_Request LTC40111EDD.exe")

AgentTesla SMTP exfil server:
mail.sesan.com.vn:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 06:58:05 UTC
AV detection:
20 of 30 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cjpndag6ktvs54bslwuwy6m4irws2hpqehsoli3fuzq6futfulea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 125ed180de54eb2ef0325da96c799c446d2d1df021e4e5a365a661e2d265a2c8

(this sample)

AgentTesla

Executable exe 83007f21c5c176001903f5ef3bf480615257fb09fd5f1981fabdcc7b618495be

  
Dropping
MD5 c67fb6f52f3d074c34d782934264a98b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 83007f21c5c176001903f5ef3bf480615257fb09fd5f1981fabdcc7b618495be

Comments