MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 188af64e89b9b5f033699efff3bcd56c376402471cf0463732913d711911ad8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 188af64e89b9b5f033699efff3bcd56c376402471cf0463732913d711911ad8e
SHA3-384 hash: 112ae450469e70c656d7160b9b7d86f599e406663a40b87e4962d842def149714f8d3c9963c8be256b527759aff291f4
SHA1 hash: 9e62ff2050fb393b8501b4e737b40f786cd2c774
MD5 hash: 49bc550fd06c9ea45808c79bdd963c2c
humanhash: hotel-sodium-minnesota-shade
File name:Purchase Order - 0006-20.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:417'279 bytes
First seen:2020-06-04 06:27:17 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:mKghgo8B9SYT8YEBxulB6yyZxOgYayeM36bO:mrgnjT87BxHyoYGO6S
TLSH 7C942343DBE65319CA85CE24E3CC62D0A1937648E07CD9DBF509BF6CA7EA4BC052650B
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.mailerhost.net
Sending IP: 185.234.216.161
From: "Miss HÙONG PHUONG" <info@iot-gen.com>
Subject: Purchase Order 0006 -20 - ( IOT GENERATION-20-06 )
Attachment: Purchase Order - 0006-20.z (contains "Purchase Order - #0006-20.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 06:37:25 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dcfpmtujxg27am3jt377hpgvnq3wiashdtyemnzsse6xcgirvwha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 188af64e89b9b5f033699efff3bcd56c376402471cf0463732913d711911ad8e

(this sample)

AgentTesla

Executable exe abe10a0978abb39e16eba5643ea751bcc4f1361d3daefa62a65daa01eae7ec3d

  
Dropping
MD5 eed0697ba0075a97d508dddf3cd305c5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 abe10a0978abb39e16eba5643ea751bcc4f1361d3daefa62a65daa01eae7ec3d

Comments