MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1632e90351f35970b2d6f4c45e84705c202150224d7fb44903b934d0d4fae050. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1632e90351f35970b2d6f4c45e84705c202150224d7fb44903b934d0d4fae050
SHA3-384 hash: a8a4c5e8d96db7529618e40149ea8e5ad35ec2bad868347a2e292a94fe17994c46f999efad0bb81066eb0733556be31e
SHA1 hash: 6fe8997671a6d2edae0f2a7006133860b2d89668
MD5 hash: c383dd2ca1198c3a015ab3937cb8592b
humanhash: finch-ohio-romeo-saturn
File name:Transfer Form.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:374'154 bytes
First seen:2020-06-07 07:40:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Q/36zX/WUbF99EURimi3Onum2zvsiInq74XPYdwVhiB3oktpQrHDTgeVWbf3sUt:Q/3YeMWQi+nu1Ix9hyo0Qrj/SfLt
TLSH 888423ADEB92243B0EC32E069F8B7DC226895B110877A353B90525D3F9F64D732F5950
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: telkomsa.net
Sending IP: 103.141.136.4
From: mahindranorthcoast@telkomsa.net
Subject: RE: PAYMENT INSTRUCTIONS
Attachment: Transfer Form.zip (contains "Transfer Form.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WEZ.20116.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-07 07:42:06 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cyzosa2r6nmxbmww6tcf5bdqlqqccubcjv73isidxe2nbvh24bia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1632e90351f35970b2d6f4c45e84705c202150224d7fb44903b934d0d4fae050

(this sample)

AgentTesla

Executable exe 672c7a3bf89e71e2bc6caf76fa62790df8841f15a4f8b1052c75fa7038d4ffb3

  
Dropping
MD5 678ccb736464d80645d6febacbea8444
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 672c7a3bf89e71e2bc6caf76fa62790df8841f15a4f8b1052c75fa7038d4ffb3

Comments