MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d5db0daf4b0bb99daeb47f39b91afa5ba7b2b0d5aa9a5915df3c22c65b9a967. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d5db0daf4b0bb99daeb47f39b91afa5ba7b2b0d5aa9a5915df3c22c65b9a967
SHA3-384 hash: 6c92702ee10a82b6d8aaefa18557f9bead70dfe5f6c1444a4d7872ebcd5a53d45d524c04a5ef9f64f9743a470a0e06ec
SHA1 hash: 135220589cd67ab0553da55f40d11a01e0cdeb05
MD5 hash: 8f9aa5f089b72c87a9ec3ba5dc96daf6
humanhash: four-maryland-cardinal-gee
File name:Order Confirmation.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:474'973 bytes
First seen:2020-07-29 06:50:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:/9lMZtsrSvV9jMZ+T1J1/hrqEIDfe8kfCTOEom/H:/zMZurSnjcIJ1/hFIDmfCCkH
TLSH C2A42390BF60EA19F6BC3E6FA0EF4C816D7DAED5FB817D0E714088BE7595C511842822
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.alphasales.cf
Sending IP: 89.32.41.116
From: Challote <contact@alphasales.cf>
Subject: Order Confirmation
Attachment: Order Confirmation.zip (contains "Order Confirmation.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23990.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1d5db0daf4b0bb99daeb47f39b91afa5ba7b2b0d5aa9a5915df3c22c65b9a967/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 23:21:53 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dvo3bwxuwc5ztwxli7zzxenpuw5hwkynlku2lek56pbcyznzvftq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1d5db0daf4b0bb99daeb47f39b91afa5ba7b2b0d5aa9a5915df3c22c65b9a967

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1d5db0daf4b0bb99daeb47f39b91afa5ba7b2b0d5aa9a5915df3c22c65b9a967

(this sample)

AgentTesla

Executable exe b5144af2c2fa337f0a4c0a26a43f3a93a57ad81566be3c80299ed0cd699d2a68

  
Dropping
MD5 e9fed5446e6db81719c287ed12d92f42
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b5144af2c2fa337f0a4c0a26a43f3a93a57ad81566be3c80299ed0cd699d2a68

Comments