MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47a24cf295e001ceaaf313642abca17db05b9b28801cb1e1eb2c892cd51e090a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47a24cf295e001ceaaf313642abca17db05b9b28801cb1e1eb2c892cd51e090a
SHA3-384 hash: 530e29990ffd69753be9c6f194c740858b261976c212943f9938733b84ab34b9ddc8b246911ffc398b6baae1c50d7bb1
SHA1 hash: 29a234f94b4a6d49df64c9c987ec9228d7e25213
MD5 hash: beb5e78dcd6770efcc3b1d3b078de5c6
humanhash: triple-indigo-mountain-oxygen
File name:Transfer Form.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:280'881 bytes
First seen:2020-06-08 08:00:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Zd4a+hS0LxxoowX8qPCsdElR6jdSOJu+AqotTOV4MYriax:ZdDES0LxxMMqqP6jdzJu7tTnMyi6
TLSH E854232588FCFB11A391031DBA873FCE16504DD2EBE1865FA42ED8B7237C063578566A
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: telkomsa.net
Sending IP: 103.141.136.4
From: mahindranorthcoast@telkomsa.net
Subject: RE: PAYMENT INSTRUCTIONS
Attachment: Transfer Form.zip (contains "Transfer Form.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WEZ.7478.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 08:02:05 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i6rez4uv4aa45kxtcnscvpfbpwyfxgziqaoldyplfseszvi6befa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 47a24cf295e001ceaaf313642abca17db05b9b28801cb1e1eb2c892cd51e090a

(this sample)

AgentTesla

Executable exe e5b41ad0f4038600aea9353a27e74c75ff7e6eb986b96cad04669fcbfa417fe7

  
Dropping
MD5 753d49d09160b3ad803927343231349d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e5b41ad0f4038600aea9353a27e74c75ff7e6eb986b96cad04669fcbfa417fe7

Comments