MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 444a90e434e81c994244e514921f76290485c7bc15495c3b08bbaaeffe479f7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 444a90e434e81c994244e514921f76290485c7bc15495c3b08bbaaeffe479f7e
SHA3-384 hash: fd5f74ce35f976572e6fe9d8740ba58c204d39745bd2685502655e0fe8d24069b7c1b6c4e2397bc51567699d29dfdce1
SHA1 hash: 2e71ca75cd171481aceeb982d63eb5ef723af9aa
MD5 hash: b569b2d03ec348be6b5561b931e9953d
humanhash: cat-charlie-september-pennsylvania
File name:wertyulkjnbvcxxcb.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:429'604 bytes
First seen:2020-06-20 06:03:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:wQABYNxGSdWwiZK+IrgQ5k6GxiseqjsW6uFI:wTYKizSBIrTkBe8sGI
TLSH 959423EEE054960D24D448F6CAE5DBCD19BEBF6C6F3268F98D863D17B3136A40E40162
Reporter abuse_ch
Tags:AgentTesla CHN geo zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.diucab.com
Sending IP: 45.95.169.249
From: Yasha Ho / Fu Hui Screw <keith@distinctivebadges.co.nz>
Subject: 我司已匯$23856 (Our remitted $ 23856)
Attachment: wertyulkjnbvcxxcb.zip (contains "wertyulkjnbvcxxcb.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FakeAlert.9060.1798.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 06:05:05 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=irfjbzbu5aojsqse4ukjeh3wfecilr54cvevyoyixovo77sht57a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 444a90e434e81c994244e514921f76290485c7bc15495c3b08bbaaeffe479f7e

(this sample)

AgentTesla

Executable exe 94c83300ebe3c3e2f911310692885aaf03f6d1df3a4c7ade24260f413989d78c

  
Dropping
MD5 9a0502b7881864ad045baa97a9de0028
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 94c83300ebe3c3e2f911310692885aaf03f6d1df3a4c7ade24260f413989d78c

Comments