MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ee90965bf59d60ea879eac7dc974bacf150b5d536969b8aa7c28d1e666898e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ee90965bf59d60ea879eac7dc974bacf150b5d536969b8aa7c28d1e666898e0
SHA3-384 hash: f02d8ecc2fbd8024df52a202abfa1654b1f4b51b188eca2502c7c48dc6609a2c0d0cf1af05ee915f0bb0babc46dbd443
SHA1 hash: 4bb6a0261029a014ad61e95d599aacf6796bedf0
MD5 hash: 37c212e6cd0c0617bd4a30154a9a35ec
humanhash: william-friend-kentucky-magnesium
File name:New Order Product Required.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:442'616 bytes
First seen:2020-07-29 06:26:53 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:q7FaN035qcUAXmUJ3PVJnnyy0dDRkJMOaNE5+:q7q0gcpWUNjyRZR8MOL+
TLSH C194234B44D971C6794FB2AC2E5B74B8A147B1F5CEB94E04BD5AE920A0161F3E931C38
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.mail.hitutorhr.com
Sending IP: 210.242.229.119
From: Marc Richardson - (Purchase manager) <bunnyedb1@hitutoracdm.com>
Subject: New Order
Attachment: New Order Product Required.pdf.z (contains "New Order Product Required.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ee90965bf59d60ea879eac7dc974bacf150b5d536969b8aa7c28d1e666898e0/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 06:28:10 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j3uqszn7lhla5kdz5ld5zf2lvtyvbnovg2ljxcvhykgr4ztitdqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4ee90965bf59d60ea879eac7dc974bacf150b5d536969b8aa7c28d1e666898e0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 4ee90965bf59d60ea879eac7dc974bacf150b5d536969b8aa7c28d1e666898e0

(this sample)

AgentTesla

Executable exe 68250b3b7bd3bf975cc34c76b31ed23634e6b2437c6fc3ae3bb6209c7eaf5402

  
Dropping
MD5 f39cd4c37c4d7c3bd09c538600ff0ca6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 68250b3b7bd3bf975cc34c76b31ed23634e6b2437c6fc3ae3bb6209c7eaf5402

Comments