MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53f960b99fdb4e906997738c31b14a3490955c43d8366f8e67c12270d56cbbf1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53f960b99fdb4e906997738c31b14a3490955c43d8366f8e67c12270d56cbbf1
SHA3-384 hash: e9feabef3681beff0d85d2967b59c75a4ef0272ad42166123396845eff044a53e247a2f8e6fae385616694bbaae45757
SHA1 hash: f1e611c41e3c1bf307e0ec620ab1aa5c46af3d1c
MD5 hash: b66861abcddf28c006b297f57cb7df9d
humanhash: utah-zulu-beryllium-april
File name:IMG 24344 NEW ORDER_PDF.r02
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'231 bytes
First seen:2020-05-19 06:53:13 UTC
Last seen:Never
File type: r02
MIME type:application/x-rar
ssdeep 6144:F2fB1Lv34D/llalsZ1R6sxeyeS4OKe474FKbkbphkGZMpITa5tJMXmLthZCaBao2:iBJ4D/l5deXOlxNhkmEtWIhx3Bwdt32u
TLSH A894237D2011DA1F9C30ED8E87F725045FA59D97612BA1EA2931548FBB41AC02F0DFE6
Reporter abuse_ch
Tags:AgentTesla r02


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.sunman.net
Sending IP: 163.47.84.12
From: Mr Willy Wong <contact@wintrad.com.my>
Subject: RE: Request for Proforma Invoice
Attachment: IMG 24344 NEW ORDER_PDF.r02 (contains "IMG 24344 NEW ORDER_PDF.exe")

AgentTesla SMTP exfil server:
mail.candenizcilik.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 07:36:12 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kp4wbom73nhja2mxoogddmkkgsijkxcd3a3g7dthyerhbvlmxpyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r02 53f960b99fdb4e906997738c31b14a3490955c43d8366f8e67c12270d56cbbf1

(this sample)

AgentTesla

Executable exe a84d2a22a173f3cd1c23c42fa2c11ad1ba34ab2ab1df8c71823e029712ae7ae6

  
Dropping
MD5 588ca298816b0e8e9e86b7206aba23db
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a84d2a22a173f3cd1c23c42fa2c11ad1ba34ab2ab1df8c71823e029712ae7ae6

Comments