MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4615389657415d2ff06489dfe0e8394977fd68922796a6a1f1afbecab466d45a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4615389657415d2ff06489dfe0e8394977fd68922796a6a1f1afbecab466d45a
SHA3-384 hash: d9fee3244f05b97d8cbb30e54848b7ae68444092f0f6310d2c445e39b1ca1640b039a30a28904b8118b21e8a7022e1f9
SHA1 hash: 8d1f4e58f782a4fb8acbf47a0d91eadc9a6ac7b1
MD5 hash: 6e709030c711516d954763ddeb1f7abe
humanhash: network-robert-single-lamp
File name:RFQ TC3363 554 ref 5578.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:813'460 bytes
First seen:2020-05-11 13:29:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:Jg6wiZuOY9W4xEp+RyqkAb848E4oIdVqZdHMEVHS:GfsqEpVAb8EnHBdS
TLSH E705332F21CA258942076A470FBA4481FF21D551609E68ECB105F07E6B937F347ABA9F
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: nammacargo.com
Sending IP: 37.49.230.190
From: hossain@nammacargo.com
Reply-To: hossain@nammacargo.com
Subject: NEW RFQ
Attachment: RFQ TC3363 554 ref 5578.z (contains "RFQ TC3363 554 ref 5578.exe")

AgentTesla SMTP exfil server:
smtp.akonuchenwam.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 13:59:47 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iyktrfsxifos74derhp6b2bzjf3722ese6lkniprv67mvndg2rna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4615389657415d2ff06489dfe0e8394977fd68922796a6a1f1afbecab466d45a

(this sample)

AgentTesla

Executable exe 61ab7d6bc7b5b5a3f90635ed4208d0528155a4283b1deb656e194caf198cba80

  
Dropping
MD5 b420ec9b5e7102e29376ed8035492676
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 61ab7d6bc7b5b5a3f90635ed4208d0528155a4283b1deb656e194caf198cba80

Comments