MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29715112a7782bb7c99eb899a16b57a7f07dda24cba607aaf5dd28466a541ffd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29715112a7782bb7c99eb899a16b57a7f07dda24cba607aaf5dd28466a541ffd
SHA3-384 hash: 7417120424ddd317b58635901260e971d9197bd0df31ced13cf8cf76e7e2b524ce127e5e4a50bfb2e67d25399963a387
SHA1 hash: a93486abf212ab63efe630f2f20d91839463968d
MD5 hash: 4eb06088e1280bc0fc171c082409367b
humanhash: hamper-four-princess-nevada
File name:EST PDA MV. TBN CALL TO CIWANDAN.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:668'504 bytes
First seen:2020-08-31 10:13:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:qxHxCyLtO51WFR9ncWH6azCAV2A6tkz/bwvQRCRcV/n5ctYj2/lc+8+3NF+lq9e:dyo516TBzCA3/bw4MRev6iy9c+8IFL9e
TLSH 23E433354730512B13DB5585049AA3B5AF17F28CAA4BC28ADB23F656C1C468FBB8FD34
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pertamajaya.com
Sending IP: 180.214.236.50
From: Julius <julius@pertamajaya.com>
Subject: Re: Port Inquiry for discharge 20000mt
Attachment: EST PDA MV. TBN CALL TO CIWANDAN.rar (contains "EST PDA MV. TBN CALL TO CIWANDAN.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29715112a7782bb7c99eb899a16b57a7f07dda24cba607aaf5dd28466a541ffd/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 04:05:56 UTC
AV detection:
2 of 48 (4.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ffyvcevhpav3psm6xcm2c22xu7yh3wrezotapkxv3uuem2sud76q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/29715112a7782bb7c99eb899a16b57a7f07dda24cba607aaf5dd28466a541ffd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 29715112a7782bb7c99eb899a16b57a7f07dda24cba607aaf5dd28466a541ffd

(this sample)

AgentTesla

Executable exe 37677fa0c9255eb7368ce3d54a42e2b3e23eff33c6e2008406d9f32a71b565b8

  
Dropping
MD5 4ef647613fe0cc757fe535d46a4763d7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 37677fa0c9255eb7368ce3d54a42e2b3e23eff33c6e2008406d9f32a71b565b8

Comments