MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17fb11d170698151536c5549e38758c76f982135785ed9a05b5844375fbfd21f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 17fb11d170698151536c5549e38758c76f982135785ed9a05b5844375fbfd21f
SHA3-384 hash: 7049799875fed5d0d133569912f345498deb4730a3616f2b5738761fe806c425323b366bb690a8fda1996b520c33457c
SHA1 hash: 95c01d3ff5d19673da784d5a25a55b392a47970b
MD5 hash: cccebab94916ff0f22b8107833b72006
humanhash: uncle-table-romeo-high
File name:PRODUCTORDER-22-05-2020_PDF.ARJ
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'631 bytes
First seen:2020-05-22 07:18:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:0N/BcnM12wLbtKT9jci26QWShxP0k5fNSMc:0N/Bc8hKTRcFxWYxMsW
TLSH 0F8423AC5207FA09536BA1541DCADF95E2260D03BCC9714BBAA515E326F05FB28CF4B2
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.214
From: Sandra Chen <sales@sanabll.com>
Reply-To: daria.casiraghi.brazzoli.it@bk.ru
Subject: Product Order.
Attachment: PRODUCT ORDER-22-05-2020_PDF.ARJ (contains "PRODUCT ORDER-22-05-2020_PDF.exe")

AgentTesla SMTP exfil server:
mail.karcek.com.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.48419.22553.31047.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 07:32:17 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
25 of 47 (53.19%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 17fb11d170698151536c5549e38758c76f982135785ed9a05b5844375fbfd21f

(this sample)

AgentTesla

Executable exe f1a70557e9f0ea790d7bfdb87a0f54cb2f5ee005e12b53f051fe91fbc8d1da61

  
Dropping
MD5 35bc11e6f9a66946d6cc137c12c4641b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f1a70557e9f0ea790d7bfdb87a0f54cb2f5ee005e12b53f051fe91fbc8d1da61

Comments