MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16b6594fb275405fac3e9d9952f639a6cae8f9098fc5422671895de9a08d3e51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 16b6594fb275405fac3e9d9952f639a6cae8f9098fc5422671895de9a08d3e51
SHA3-384 hash: 77472bb6f1563be4c506c7a74bc54687d841e65f52b9016b7ecf00a943ed89b3b4cfe7076d26744a71d6960f55b18a0f
SHA1 hash: 6550f57e889aa64ee62e11cb7930c42bf72c5a82
MD5 hash: 776cd4799df73d3e9430b0f77093aad4
humanhash: jupiter-pasta-yankee-autumn
File name:DOC09090000.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:392'950 bytes
First seen:2020-06-29 07:47:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:0vDb2U9FT/K3rs+U5exUzArilqvxxM+ZdPvIjqpohmgdbxlAB8SyeT9658lkI5ha:a99FTlDRl1+nvFohmKlYa6WI5h5Qvcp6
TLSH 5384231D99E0812E18D8E9F3CFB6AB2A074CBC5B84B13D4911ED7E8492DBD0CE95D631
Reporter abuse_ch
Tags:AgentTesla geo VNM xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: serv.ipblasta.com
Sending IP: 5.39.217.214
From: business@thesilkwood.com
Reply-To: saleslink@yandex.com
Subject: Hóa đơn thanh toán / Đơn hàng mới
Attachment: DOC09090000.xz (contains "DOC09090000.exe")

AgentTesla SMTP exfil server:
mail.ereglitso.org.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ENGK.190.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/16b6594fb275405fac3e9d9952f639a6cae8f9098fc5422671895de9a08d3e51/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 07:49:04 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c23fst5sovaf7lb6twmvf5rzu3for6ijr7cuejtrrfo6tienhziq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 16b6594fb275405fac3e9d9952f639a6cae8f9098fc5422671895de9a08d3e51

(this sample)

AgentTesla

Executable exe f8e20d964fee50b5c359d91fac02115f74abb37f769c5d1869bbe2fcf22deebb

  
Dropping
MD5 01cc5dc7f45de109173e3a272f458c8e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f8e20d964fee50b5c359d91fac02115f74abb37f769c5d1869bbe2fcf22deebb

Comments