MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52977c9b9eab04abbbf62bfb18501cf1df4d817e535705d2b7c3d7f8e963f19c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52977c9b9eab04abbbf62bfb18501cf1df4d817e535705d2b7c3d7f8e963f19c
SHA3-384 hash: e17a90d67caeaeafb236f42fbc657626b87388840e74281d89bd8495f88cfb4f52ec91c019b7cda4c049e850abbae2ba
SHA1 hash: 285b22510f4ab97cf6684749d8f81cf6c0bdf168
MD5 hash: f25f6c2612938328af982cc769f663ca
humanhash: red-east-sad-romeo
File name:RFQ 502480987.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:455'047 bytes
First seen:2020-05-01 15:23:15 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:o4nhBSMyBHLTkvBaW9vX1NvyCRmrynNM9E:o4hBKnkZaE/jvDRmrF9E
TLSH A9A4230D79CFF4184E8A6F6B36B38332D225D34E97B9F1166C58C684EB4D323A4648E5
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.grupoescala.com
Sending IP: 82.223.18.162
From: Brouwers Adrian <adrian.brouwers@kautex-group.com>
Subject: RUSH-INQUIRY RFQ 50248987 KAUTEX MASCHINENBAU GmbH - NEED YOUR OFFER\x0a UNTIL MONDAY - NEED AN OFFER WITH FABRICATED OPTIONS
Attachment: RFQ 502480987.gz (contains "gunzipped")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.43686.1002.14140.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 15:36:06 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kklxzg46vmckxo7wfp5rqua46hpu3al6knlqluvxypl7r2ld6goa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 52977c9b9eab04abbbf62bfb18501cf1df4d817e535705d2b7c3d7f8e963f19c

(this sample)

AgentTesla

Executable exe 0f3796394a5e425855d842187813997be61e79058cfc546da575b27cf8c09ffb

  
Dropping
MD5 b5a010678795bb33fbb73b20586da186
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0f3796394a5e425855d842187813997be61e79058cfc546da575b27cf8c09ffb

Comments