MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c222b952d42120aa3dfc39047149e8ceb06e1ef874696a00e78b0c8f60bb6ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c222b952d42120aa3dfc39047149e8ceb06e1ef874696a00e78b0c8f60bb6ca
SHA3-384 hash: 008b92bfcd41bb3da75b296e3b84bb1bbecd2d0d6795dcaf1f8243a3c44e4ba900d6e4453745a118b56b018d6a169430
SHA1 hash: fd4dc8041f121ad1827a4e94cf5fed172b04d3a2
MD5 hash: 78a7c893bcf3e2c3b62fcec5c0a9b1f7
humanhash: sweet-jupiter-berlin-mobile
File name:Dispatch Note - 6183111.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:412'658 bytes
First seen:2020-05-14 06:24:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:sqVGEXuFZPY8G/OE2TtBSYVY6bNqMkei+mPGy+ZDYpgeNisD3PhSYgOTeg+FAtr9:qZPYpzQQYVZNqdeHg8qiGSYgwoFAtx
TLSH AC9423F5F7CEE0A68727B81A0975D0B77780423A119EED3D54FE00606A7D026C298BE7
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: madison.co.uk
Sending IP: 103.207.38.237
From: customercare <customecare@madison.co.uk>
Subject: Dispatch Number / Consignment  -  6183111
Attachment: Dispatch Note - 6183111.zip (contains "Dispatch Note - 6183111.exe")

AgentTesla SMTP exfil server:
mail.dormakeba.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis79E10FE02B8C.31335.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 04:18:57 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hqrcxfjniijavi67yoieofe6rtvqnyppq5djniaopcymr5qlw3fa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3c222b952d42120aa3dfc39047149e8ceb06e1ef874696a00e78b0c8f60bb6ca

(this sample)

AgentTesla

Executable exe 39dc873bb74e369b04ba0b7c06fae772f38b68f7f7faf5cd80fed361664cc2c7

  
Dropping
MD5 79e10fe02b8c4bdf8ff99b3d41dd297c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 39dc873bb74e369b04ba0b7c06fae772f38b68f7f7faf5cd80fed361664cc2c7

Comments