MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f4d66b5eb51903521695bcda30bc23975a60a0f4482bbc6eef7e0798260a0b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f4d66b5eb51903521695bcda30bc23975a60a0f4482bbc6eef7e0798260a0b0
SHA3-384 hash: 0a2e371eaa608a00f924989c4ba3b0ed6f79629d9d0b9f3e9c546c3ffef704438cc8a47568f2b136bed7a2ae9bafb3d4
SHA1 hash: c0f2addd1bddc4005a901154cb2ca659faed9837
MD5 hash: 0abdc4ea3b998d71e0568d5955b77a7a
humanhash: solar-mississippi-july-king
File name:Documents.RAR
Download: download sample
Signature AgentTesla
Create hunting rule
File size:660'850 bytes
First seen:2020-08-04 13:29:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:1SbtgooSXS/ZJ9CWUZec0h1NU7r0xh7vICwzEIKlEu4A2KVUF+A31qGP060:SmhEiyk160xhDIEIK74Apm2F
TLSH E7E433DDD84EF8D97C7865A9C0AA132299D68E71C39727E379433D8DD8803A0857B2CD
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: debbieltd.pw
Sending IP: 104.168.143.233
From: IMPORT-EXPORT SALES <info@debbieltd.pw>
Subject: Purchase Order No. 030620/D21-16 “ABB”
Attachment: Documents.RAR (contains "sZgSrk0ddM2UKGg.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f4d66b5eb51903521695bcda30bc23975a60a0f4482bbc6eef7e0798260a0b0/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 13:31:05 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j5gwnnplkgidkiljlpg2gc6chf22mcqpisblxrxo67qhtataucya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4f4d66b5eb51903521695bcda30bc23975a60a0f4482bbc6eef7e0798260a0b0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 4f4d66b5eb51903521695bcda30bc23975a60a0f4482bbc6eef7e0798260a0b0

(this sample)

AgentTesla

Executable exe c7cf8db43e28e6c2c6f3512f5f445ed648f1bdf2a067db4f29e7713f83dd4238

  
Dropping
MD5 1ca19bcb37ae4f847ac432d8f4166c71
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c7cf8db43e28e6c2c6f3512f5f445ed648f1bdf2a067db4f29e7713f83dd4238

Comments