MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5560b322ce8bfa4f9633f7feb0ffb42b491798556f344aba15910ed692e1b8d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5560b322ce8bfa4f9633f7feb0ffb42b491798556f344aba15910ed692e1b8d9
SHA3-384 hash: f2b72c8e5131562503deab6c65772c9ac2f8efada2a84e53eb8e760a1c426b5e8a6843bfefb4c4de475345eebb2af926
SHA1 hash: 7e101b9d443001e8c06cbc7d56452a7058df1ad8
MD5 hash: 6ff49bdd271ba46c25be83e36f329261
humanhash: glucose-london-east-foxtrot
File name:salinan resit 000201106012020.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:473'882 bytes
First seen:2020-06-02 06:43:15 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:ibvWXQssN7fDIppWYt/8f1DgRn1DQC93SYc:ii/sN7fDIpcm/W1Dkx3SYc
TLSH EEA42310194701EF8B408A8AD6BA10673EFCF955B3F854448FB93AE8CF7D569A10D71B
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.processing.ro
Sending IP: 86.107.224.178
From: Gina Chua <ginachua15@gmail.com>
Subject: Salinan resit
Attachment: salinan resit 000201106012020.7z (contains "salinan resit 000201106012020.exe")

AgentTesla SMTP exfil server:
mail.ductoslimpios.com.mx:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 09:22:58 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kvqlgiworp5e7frt677lb75ufnerpgcvn42evoqvsehnnexbxdmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 5560b322ce8bfa4f9633f7feb0ffb42b491798556f344aba15910ed692e1b8d9

(this sample)

AgentTesla

Executable exe 8756c4f14d4d8cb6449ced8a65ffd2cdf3aac1bfdc4c1c6838fbdbcf1f9e11fd

  
Dropping
MD5 4264eb8df3046b3a266763db5e4cb1e2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8756c4f14d4d8cb6449ced8a65ffd2cdf3aac1bfdc4c1c6838fbdbcf1f9e11fd

Comments