MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 443b240600a815ff75e2ca2384378ad588392f6be127dbf48c7c51d64630aef8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 443b240600a815ff75e2ca2384378ad588392f6be127dbf48c7c51d64630aef8
SHA3-384 hash: 3c944e6317363f8982bfa4e904f3539b0943a7434d06826111033bc2fe1f320566c034eb45564d891a1efc14314e0357
SHA1 hash: 59332e8228a11dd6952d131eb22fa54d82258051
MD5 hash: 3bba573bf136965cd0af431a4cdb9005
humanhash: carbon-montana-burger-grey
File name:P.O202315........pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:400'114 bytes
First seen:2020-05-13 09:52:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:y7/8bmvNzwyWWRMnufgtj9le9gCGO47C7buQrewApfcpnQKLThjvfGPtJ81Klmsi:u8beSdHyM2ZryEQKL93Gwvaqv
TLSH 3884231DD14F2EB9962E8CEEE64A1143F21829C4ADA0B191F0145D913BBF3B066D7F1E
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gl-host101.tenten.cloud
Sending IP: 150.95.111.186
From: Wendy Zhang <wzhao@onececo.com>
Subject: Urgent PO. 202315
Attachment: P.O202315........pdf.zip (contains "P.O202315........pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 20:59:55 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
33 of 48 (68.75%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iq5sibqavak765pcziryin4k2wedsl3l4et5x5empri5mrrqv34a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 443b240600a815ff75e2ca2384378ad588392f6be127dbf48c7c51d64630aef8

(this sample)

AgentTesla

Executable exe 3497f186cb8e8ee119f82a97445bb6a6d75a73d480a57c12a864fcb7e8b3b725

  
Dropping
MD5 d3d2840a386b1256d610a136163bd565
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3497f186cb8e8ee119f82a97445bb6a6d75a73d480a57c12a864fcb7e8b3b725

Comments