MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 530423a772a313f731ecc6b638a50f3c2bd110dabf9848d41f8457b17efcf6cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 530423a772a313f731ecc6b638a50f3c2bd110dabf9848d41f8457b17efcf6cc
SHA3-384 hash: c8e6e14cb165453675ea30830fac230c4909b9eba56767d825c077663b497c456924c88d36c68b90b96dd87d8b76bddf
SHA1 hash: c2c5a236026ab4c8b0d01d32ff7466721a63c401
MD5 hash: ed00967520fb02a81227c2b7bfc24cd1
humanhash: undress-alaska-minnesota-sierra
File name:PI 59620 -MAI spareparts.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:397'814 bytes
First seen:2020-06-15 05:32:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:K4ANMlaTypHtIMbRwNZN3IoZhjD7PAJ8p1FU:KPNMUXGWNnnX283u
TLSH D98423672D7F0872FA6475CC595498CF0A36F8EF864272B91A01463BF63D25A237B134
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ka.karnivelapi.live
Sending IP: 45.95.171.209
From: Mohideen Ketat <m.ketat@serapid.com>
Reply-To: m.ketat@serapid.com
Subject: RE: Invoice-Ex Factory Shipment For Our Client
Attachment: PI 59620 -MAI spareparts.zip (contains "7vzM3u1BUHVpNk1.exe")

AgentTesla SMTP exfil server:
smtp.usamilitarydept.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.34016426.19424.29719.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 05:34:06 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kmcchj3sumj7ompmy23drjiphqv5ceg2x6merva7qrl3c7x463ga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 530423a772a313f731ecc6b638a50f3c2bd110dabf9848d41f8457b17efcf6cc

(this sample)

AgentTesla

Executable exe 17f583d0dbe0207abb037690c7fab3fd697a9f6112c4c4a6e67461b06546daf0

  
Dropping
MD5 6c0b95a180875da0b3e9e74cd9c99721
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 17f583d0dbe0207abb037690c7fab3fd697a9f6112c4c4a6e67461b06546daf0

Comments