MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 229e1e292b76f906d33a2ef040cb4089ed08c60469137bc385dbe54bb6bb0eab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 229e1e292b76f906d33a2ef040cb4089ed08c60469137bc385dbe54bb6bb0eab
SHA3-384 hash: 068f3b3dd6962dfe2793a3f0c5fd221d4af8986312fdec7af0b9edec6c6e0b43fd28967fd96c61083e2b543e956655ad
SHA1 hash: 68af0b4b3c42721909eee594f173183f78b53e18
MD5 hash: baa55c4a48111bd6ebe76b7a76101c25
humanhash: cold-lake-uncle-hamper
File name:Universal310720.Z
Download: download sample
Signature AgentTesla
File size:445'375 bytes
First seen:2020-07-31 12:16:02 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:U5S+XMIlCj/7Lw5ePKPAA35vBulyhpI8xWgJRGd8PR:U5S+XMIAj/7LQePKPAAJvD/I8XRGGPR
TLSH 7A9423460FA8764DDF05632625C4CF24AE07BE7D4C78ABB63A383A80D296B05D17D7B0
Reporter @abuse_ch
Tags:AgentTesla z


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: abaad.om
Sending IP: 37.49.230.200
From: Syamkumar Korat <syam.kumar@abaad.om>
Subject: Bank Transfer Advice
Attachment: Universal310720.Z (contains "Universal310720.exe")

Intelligence


File Origin
# of uploads :
1
# of downloads :
35
Origin country :
FR FR
Mail intelligence
Geo location:
IT Italy
Volume:
Low
Geo location:
Global
Volume:
High
Vendor Threat Intelligence
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-07-31 12:17:05 UTC
AV detection:
16 of 31 (51.61%)
Threat level
  5/5
Threat name:
Legit
Score:
0.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 229e1e292b76f906d33a2ef040cb4089ed08c60469137bc385dbe54bb6bb0eab

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments