MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49e0991e82c2124d2fdcc712b807bd8b787b3523968e0bc3d76580860cab3364. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49e0991e82c2124d2fdcc712b807bd8b787b3523968e0bc3d76580860cab3364
SHA3-384 hash: d546887d030d4c79e0dfb3dfc4ee65d8d9bd590fd93c8b4627af5995dbf88dfb2e36a70eed8ffc8f65b788a9ce33f62b
SHA1 hash: 998892b16d437445d95796778bb35330bac4f7d1
MD5 hash: 4ecd59916255043f85c8fbeb14b70195
humanhash: delaware-pip-sierra-fillet
File name:TT COPY.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:387'892 bytes
First seen:2020-05-13 06:03:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:c0ClwhncV7oya+A1u0iHeinNWx+dXj7Vn+VouN1z0Woh:NEkncBa+AQ+4NW4Vn++Gtdoh
TLSH 6B8423207F23F6BB8518554BB3C915C9C0EDEACE8426391B6DEB04311DA905EF6C3A9D
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.artkartel.xyz
Sending IP: 64.227.121.239
From: CARGO WORLD CONSOL CO., LTD <abubakar@dawoodtex.com>
Subject: RE: PAYMENT COPY
Attachment: TT COPY.zip (contains "37oz0X1I1RXPZB1.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 04:06:27 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jhqjshucyije2l64y4jlqb55rn4hwnjds2haxq6xmwaimdflgnsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 49e0991e82c2124d2fdcc712b807bd8b787b3523968e0bc3d76580860cab3364

(this sample)

AgentTesla

Executable exe a16dfaedf16e8d06d4ea34310783c87b80071eb28757f495c3e5719918a1f996

  
Dropping
MD5 28aa01e2e41d222e733d9c4cf73ecd1e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a16dfaedf16e8d06d4ea34310783c87b80071eb28757f495c3e5719918a1f996

Comments