MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17d6439271f4477108c1860c6f2a27d2d786311ec9210f4ac7c7e98c2dff99df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 17d6439271f4477108c1860c6f2a27d2d786311ec9210f4ac7c7e98c2dff99df
SHA3-384 hash: 851139285ad8cc57be329a990f0f55f93601d97090251a05dc816da50bfb0c13c9a108931cd994c5d5cc52a96e01c916
SHA1 hash: c370dca3b53a8e428416872a910d2f4632787646
MD5 hash: 1b168e3eb79baf35ececd22552bc11e9
humanhash: oklahoma-whiskey-stairway-washington
File name:ORDER5091004.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:370'104 bytes
First seen:2020-06-11 05:51:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:brXpSg7WpIR0viu38dxztZyLU8eBTs70/fWsJxmOyruZnwprRj0ZNbm7th:RSg7xWviE8zz/yg8oRfftyruw1SNbm7j
TLSH 0A74238FE45D39A6F2208572310B8D915622D41F8872550FAF5C5A2BB77372EF434AEC
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: regular1.263xmail.com
Sending IP: 211.150.70.195
From: 帕金森 <pepsontoys4@pepsontoys.com>
Subject: Re: Revised Order.
Attachment: ORDER5091004.7z (contains "ORDER5091004PDF.exe")

AgentTesla SMTP exfil server:
webmail.link-electrical.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EMHL.24330.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 05:53:06 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c7lehetr6rdxccgbqygg6krh2llymmi6zeqq6swhy7uyylp7thpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 17d6439271f4477108c1860c6f2a27d2d786311ec9210f4ac7c7e98c2dff99df

(this sample)

AgentTesla

Executable exe 9d21929837be7be38702aeec7f2ed51f23ecb142651fed5dd9d95eecd457a25e

  
Dropping
MD5 2bc66c6012709b0a2f8a2591b7b57272
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9d21929837be7be38702aeec7f2ed51f23ecb142651fed5dd9d95eecd457a25e

Comments