MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39961f6845df4e9eb0fa85c8b0bc753075eedf3275944600631ba56afefc2973. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39961f6845df4e9eb0fa85c8b0bc753075eedf3275944600631ba56afefc2973
SHA3-384 hash: 18300fe9fbcd1018fb3f1a274f0b72f4f1a54f0b0535e333c90b21b9ed2a08fb2118552ab44ed1a6c55bc408bc30a8c9
SHA1 hash: c08fc48a374166badf148c5834f74fbf5d2dd9a9
MD5 hash: ab2fbe32ebe4a2f68c9bb019d0119ed6
humanhash: montana-foxtrot-speaker-violet
File name:Curriculum Vitae.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:489'997 bytes
First seen:2020-07-21 10:06:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:wmQFWdBPQy7yC5zvsfLJKJrIWehXMmR5x3i:wTgLQUNELQJSXM8G
TLSH 36A4232CAC20543E76D9917C842D3749B95E7A1A52C0A712433CBECCB27775F0AB8DE9
Reporter abuse_ch
Tags:AgentTesla geo PRT zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps-222051.ku2.com.mx
Sending IP: 162.214.112.131
From: Mary annabelle <mary.annabelle@gmail.com>
Subject: Aplicação como Secretario
Attachment: Curriculum Vitae.zip (contains "Curriculum Vitae.exe")

AgentTesla SMTP exfil server:
smtp.pharco--corp.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.24377.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/39961f6845df4e9eb0fa85c8b0bc753075eedf3275944600631ba56afefc2973/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 10:07:04 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hglb62cf35hj5mh2qxelbpdvgb265xzsowkemadddoswv7x4ffzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/39961f6845df4e9eb0fa85c8b0bc753075eedf3275944600631ba56afefc2973

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 39961f6845df4e9eb0fa85c8b0bc753075eedf3275944600631ba56afefc2973

(this sample)

AgentTesla

Executable exe 5bb841161ff484e03a7cfe4ffe1ec77920ec61ab2e8eafa0c63e15b749ca34cb

  
Dropping
MD5 5d0b272074dfbb2f95c6fcdd2f4e6571
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5bb841161ff484e03a7cfe4ffe1ec77920ec61ab2e8eafa0c63e15b749ca34cb

Comments