MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49c837145fbd782ec5b88ef0e9fae6369dd233c30102d948ab7a1c22344fc82d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49c837145fbd782ec5b88ef0e9fae6369dd233c30102d948ab7a1c22344fc82d
SHA3-384 hash: c20b2a856be5057e173ad82aa37f160abe9fd2fdda0c920732e0b3d4d6c3c0d10f5d19693a09a76e2f2d8bc95cfa7cd6
SHA1 hash: 5e578c83c523d21287071a2f763b2cc2f9e84ba4
MD5 hash: 66ef73e51c884f0b8c7a0c4217301841
humanhash: black-saturn-crazy-kilo
File name:74167.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:404'391 bytes
First seen:2020-06-18 06:05:25 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:ofx8dT7YknwiWbf1kg9CZzvde4yGglAfNBrNWKyD7WXf:op8dnYQmb9ktzBqlAfNBrN1Xf
TLSH 4784230917049EF436B08109C4DFF996B912AE46E71C54AF205721E81BBF6F5B39E0AF
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.bontechnologies.com
Sending IP: 46.4.133.15
From: Micaela Ison <micaela.ison@nakheellandscapes.com>
Subject: PO - AN74167
Attachment: 74167.pdf.z (contains "74167.exe")

AgentTesla SMTP exfil server:
mail.retramtrading.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 06:07:05 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jhedofc7xv4c5rnyr3yot6xgg2o5em6daebnssflpiocencpzawq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 49c837145fbd782ec5b88ef0e9fae6369dd233c30102d948ab7a1c22344fc82d

(this sample)

AgentTesla

Executable exe 02486216811617717b2ab99790c57e0ffd5cc096404aca7d26d95d400b0d762f

  
Dropping
MD5 08c648ec97633ff788c2f5c6f45bbaa9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 02486216811617717b2ab99790c57e0ffd5cc096404aca7d26d95d400b0d762f

Comments