MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5100e79a448ae91b53f25c15f689ae605b417b4b1436e5bf24268d9eb499ca7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5100e79a448ae91b53f25c15f689ae605b417b4b1436e5bf24268d9eb499ca7b
SHA3-384 hash: 33ee6b43dbd011e2946cfb96e8b682d578270a8cfaf87c3c1f3f0cdf257da7688003e96cc28116d673184f1e30c0de87
SHA1 hash: 8aa59bfaa5caf650f3cfb30d23fcd9e9473e2742
MD5 hash: 6da2e4cf7d3332421943872607bab2a3
humanhash: bacon-happy-gee-mississippi
File name:MT Golden Jupiter.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:424'080 bytes
First seen:2020-05-13 06:57:58 UTC
Last seen:2020-05-13 09:16:50 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:fcX5ah/3HFMFu9uDrPCOfU/tKHyushRbbbolxZxktM4uWOx/MpGBeb3Mz7nwqL+v:Rh/AIunPCkU/dIPktXOtMYBEOKv
TLSH 9A94236B6B6D4C52F88A4CFAC3CFDAEA5531285456CED315A5007B4CF0E97EAE13C890
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail0.59.menxtinuon.casa
Sending IP: 68.183.84.39
From: "J.Y. Lee" <jylee002@chemwayglobal.com>
Subject: MT Golden Jupiter V.354 - Agency appointment (Yeosu)
Attachment: MT Golden Jupiter.rar (contains "MT Golden Jupiter.exe")

AgentTesla SMTP exfil server:
secure197.inmotionhosting.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 07:36:49 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
15 of 31 (48.39%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=keaopgserlurwu7slqk7ncnombnuc62lcq3olpzee2gz5nezzj5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5100e79a448ae91b53f25c15f689ae605b417b4b1436e5bf24268d9eb499ca7b

(this sample)

AgentTesla

Executable exe b94b255e05a2792ad302c0c398099cbc6f6eb67212dd2c5fcafbe80a13f9b946

  
Dropping
MD5 47821979d2951dc788a811d1235ba7b1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b94b255e05a2792ad302c0c398099cbc6f6eb67212dd2c5fcafbe80a13f9b946

Comments