MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 473750f1cbaffddf17ad9261f553d41aa6261372a5b8514248b244304d121cb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 473750f1cbaffddf17ad9261f553d41aa6261372a5b8514248b244304d121cb4
SHA3-384 hash: 06d811f28be2f7f526c77c34cabaab686b61af0adcae1d544d6b9321fa5a90d75467efcf52c47b78617a38974b2a9fa6
SHA1 hash: b42f073a83cfe6cc4a89d6f662079ef711cc67c1
MD5 hash: e909ed9154bffecbc917a466474e7830
humanhash: nebraska-carolina-violet-lima
File name:REQUEST FOR QUOTAION.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:393'030 bytes
First seen:2020-06-10 07:23:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:8aVF2QEqD374Ts8hBsetZnSslCrkPhSl6fgWELOxkSxHsp+FyrKDaSMdA61BHmgt:8a72QEKETxZMeheOJHsEFyrKoR/rd
TLSH 5E8423463C621200D5AA3EF7669AB00CC63B1DDC378356FBFA7B0B6216D905E0558F75
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp1.kaist.ac.kr
Sending IP: 143.248.5.228
From: 강병범<future_man2022@kaist.ac.kr>
Subject: REQUEST FOR QUOTATION
Attachment: REQUEST FOR QUOTAION.zip (contains "REQUEST FOR QUOTAION.exe")

AgentTesla SMTP exfil server:
secure231.servconfig.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 07:25:06 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i43vb4olv7656f5nsjq7ku6udktcme3suw4fcqsiwjcdatisds2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 473750f1cbaffddf17ad9261f553d41aa6261372a5b8514248b244304d121cb4

(this sample)

AgentTesla

Executable exe 0eac51656d075f31f5f63dcb1514416a612eedef9bb85d119ecadf94c81d0386

  
Dropping
MD5 acef963e37eb778b7f8b0f7c18b244cf
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0eac51656d075f31f5f63dcb1514416a612eedef9bb85d119ecadf94c81d0386

Comments