MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 384defabd1019ea4e734dd397b51659a8efb0384a0d4fe58bb3a1d6ae2ea7552. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 384defabd1019ea4e734dd397b51659a8efb0384a0d4fe58bb3a1d6ae2ea7552
SHA3-384 hash: e04022320b923329e0c1efbf8ff2cd400c58b428b87281b3eb9c1cbaf1ed599ffc6b9bc81b366830ee56c839b2f17344
SHA1 hash: b275a18bc6ce38ba8a7f79457884a490bc06e246
MD5 hash: 6246ecae009741fb1b089c4db0747a99
humanhash: tennessee-twelve-cardinal-tango
File name:CTM FOR MT. WOOJIN EVELYN.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:434'262 bytes
First seen:2020-05-11 08:54:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:4Rt8IkxiAnG0VkGaP7Uu+s7LOcf2H+vfVov:At8txiAncNjUu+sXOcfe+vfVov
TLSH DC94236885FB925F36DD34B2731253DCDAA4C530A0E3AE90E7E24A4D6F39D2D03435A6
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail0.64.menxtinuon.casa
Sending IP: 157.230.42.138
From: OJS / yg yun <ojs@ojshipping.co.kr>
Reply-To: thomas.wright2005@gmail.com
Subject: CTM FOR / MT. WOOJIN EVELYN
Attachment: CTM FOR MT. WOOJIN EVELYN.zip (contains "CTM FOR MT. WOOJIN EVELYN.exe")

AgentTesla SMTP exfil server:
smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.45506.2834.20488.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 09:36:22 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hbg67k6ragpkjzzu3u4xwulftkhpwa4eudkp4wf3hiowvyxkovja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 384defabd1019ea4e734dd397b51659a8efb0384a0d4fe58bb3a1d6ae2ea7552

(this sample)

AgentTesla

Executable exe 852a56f32acf5fd08621425269ad1980d54d40a45a2d9ef45e535edafb078098

  
Dropping
MD5 fced44984bbe8dd9c343c21d46cb9ded
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 852a56f32acf5fd08621425269ad1980d54d40a45a2d9ef45e535edafb078098

Comments