MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 234f6413a29fd682d75e754921a6c5fd19d470cc24835f34636d28f06a0fa956. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 234f6413a29fd682d75e754921a6c5fd19d470cc24835f34636d28f06a0fa956
SHA3-384 hash: 5edc6f4e9b843b6b66cb47435d04197b5841e6c641610cdc74646ad5b6969c3cffd276ad0b6743c64c3eff206ced5bde
SHA1 hash: c5bf1f837641c84850f2f72b437615485cb55aad
MD5 hash: 512a8fb7b848c5ae125b7a6a8c9a9986
humanhash: king-artist-rugby-four
File name:Order-Item list.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:495'717 bytes
First seen:2020-07-29 14:28:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:/F8M7CJXq7XfP0eCXVEzxFztvFrs3lA7Vradnq9:/yM7CJXM3CkFRNwA7F9
TLSH D4B4232AD2A89C85EAE89C17D42ED086E75BB83F4941362DD58D73E3FC4B3E11711A30
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: rensin-chem.com
Sending IP: 103.133.104.130
From: vicky <vicky@rensin-chem.com>
Reply-To: vicky@rensin-chem.com
Subject: Client New Order
Attachment: Order-Item list.zip (contains "Order-Item list.exe")

AgentTesla SMTP exfil server:
mail.pkfpmes.co.ke:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24083.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/234f6413a29fd682d75e754921a6c5fd19d470cc24835f34636d28f06a0fa956/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 14:30:07 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=enhwie5ct7lifv26ovesdjwf7um5i4gmesbv6nddnuupa2qpvfla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/234f6413a29fd682d75e754921a6c5fd19d470cc24835f34636d28f06a0fa956

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 234f6413a29fd682d75e754921a6c5fd19d470cc24835f34636d28f06a0fa956

(this sample)

AgentTesla

Executable exe af905972a17e26abbcdb1b00d7ce10499707d2a3c42f5a9584a4823adf1a1c0e

  
Dropping
MD5 e50062929312e517c158965db1858662
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 af905972a17e26abbcdb1b00d7ce10499707d2a3c42f5a9584a4823adf1a1c0e

Comments