MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a5e1ed4b9964dcdd7cde073305c74485b65187ec8d07c5599e8d6fcdd9e579a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a5e1ed4b9964dcdd7cde073305c74485b65187ec8d07c5599e8d6fcdd9e579a
SHA3-384 hash: 6b3fc6f0c6dd02c21eea0c9a9c8c613cdbcc20ebd2c1c31987a82c97b1f84b6988e257ed22c5e7b77cf2c625191790d9
SHA1 hash: 41685c15aeaa50e75da69f847cdfeaeecdef529e
MD5 hash: 16bde01b294b54f1c1a014b95733f4e5
humanhash: alabama-tango-jersey-stream
File name:AGENCY APPOINTMENT.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:608'036 bytes
First seen:2020-05-04 20:44:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:NZJOBlTqdEosoG4sD/kQ9gbPDihPgSvsQ2Le2WAKQbt34MXSwnFGZhjX/GZ28VlN:NGpqJsoGNMbPD9SvsQ2Le2HbpSOHN
TLSH 2CD42306FD32887C989E52060FB74B54DF7D43923DEF652E2876A9292437C8B347EA44
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dsg.org.in
Sending IP: 103.228.112.136
From: STANDARD SHIPPING CO <allen@standardshipping.co.kr>
Reply-To: thomas.wright2005@gmail.com
Subject: MV New Excellence - voy 2000413 / DISCHARGING ABOUT 30,\x0a 700MT OF BULK SUGAR AT BUSAN-SOUTH KOREA (AGENCY APPOINTMENT)
Attachment: AGENCY APPOINTMENT.rar (contains "(AGENCY APPOINTMENT).exe")

AgentTesla SMTP exfil server:
smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 03:44:36 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
14 of 30 (46.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hjpb5vfzszg43v6n4bztaxdujbnwkgd6zdihyvmz5dlpzxm6k6na._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 3a5e1ed4b9964dcdd7cde073305c74485b65187ec8d07c5599e8d6fcdd9e579a

(this sample)

AgentTesla

Executable exe 774cabba771d38532276d09fea65d562a9eac297737d74e937695877d21f1958

  
Dropping
MD5 d4a3aff6b454d622bebdaea940b69508
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 774cabba771d38532276d09fea65d562a9eac297737d74e937695877d21f1958

Comments