MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32cc9b5ee5bbd761da296423c3dd087e325c560777d64409246c98d531e17d51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32cc9b5ee5bbd761da296423c3dd087e325c560777d64409246c98d531e17d51
SHA3-384 hash: 065d85f0b3256f858f0ab7e341294ca82160b0ed0c31408c9dff055ba2a5223c657db2822d45d1dd2144077a0abbe8a5
SHA1 hash: 8fefe5683d451e8768e129410c9a71d3bd1d91b1
MD5 hash: 43bdf7994bbf70accb3b12446a14e02f
humanhash: stairway-tennis-stairway-wolfram
File name:Specification Details.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:303'143 bytes
First seen:2020-07-13 11:09:56 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:/rCxex9gGuG9vtUjyE80YvcgpShEq0B/oNGY9B7qaw/ZCAdB:/Nx1uaGx8wgoEfB/sGCIBBdB
TLSH A6542335EF1395CCAA78DC8CDD1E4CD27B2F68CE7461D01690886F99A15E8349A0F12F
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lums.ac.ir
Sending IP: 209.58.149.69
From: Lic. Pablo Previtali<support@lums.ac.ir>
Reply-To: support@lums.ac.ir
Subject: Inquiry 2020
Attachment: Specification Details.7z (contains "Specification Details.exe")

AgentTesla SMTP exfil server:
smtp.ldksportsequipment.com:587

AgentTesla SMTP exfil email address:
ivy@ldksportsequipment.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32cc9b5ee5bbd761da296423c3dd087e325c560777d64409246c98d531e17d51/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 11:11:05 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=glgjwxxfxplwdwrjmqr4hxiipyzfyvqho7leicjensmnkmpbpviq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 32cc9b5ee5bbd761da296423c3dd087e325c560777d64409246c98d531e17d51

(this sample)

AgentTesla

Executable exe 4a24b2956a14965470b571d6a10e49a02cfe82734ed4a1c2e5829e1f7ccf28fe

  
Dropping
MD5 938d0a880dca59c6b8e5c4478ff82e53
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4a24b2956a14965470b571d6a10e49a02cfe82734ed4a1c2e5829e1f7ccf28fe

Comments