MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55848c2d1511ad7ff88d78ffcfd3eec897ec38713a3633c34ff87d791ddd372b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55848c2d1511ad7ff88d78ffcfd3eec897ec38713a3633c34ff87d791ddd372b
SHA3-384 hash: f93a72ddbbfb194d3dca2dc99149a59e34d973e692f1bdc619018af986d3fe30abae31b14ecad3ced4be38541bbc70de
SHA1 hash: acd050e6a49a806cc7475587a35f5837eccd6920
MD5 hash: ad0434f0907b5fe8cccce6a09b63297c
humanhash: oranges-six-solar-kansas
File name:MV ASIA EMERALD II.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:416'852 bytes
First seen:2020-06-09 05:41:52 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:XHqMpZKd9N/xeCyKEPfrLQS7o5nnqeBHHq5da:XHRpZKdQWEPfc9rBHK5da
TLSH 719423604B79F46FAE12A18CACE47D05BBA274ED6337F2058D40389C36AFBC565074A8
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail0.767.domiwpo.press
Sending IP: 206.189.142.170
From: Sammy Chung <ops@nobumarine.com.sg>
Reply-To: thomas.wright2005@gmail.com
Subject: MV ASIA EMERALD II - Disch 55,000mt coal in bulk- ETA JUNE 20TH
Attachment: MV ASIA EMERALD II.rar (contains "MV ASIA EMERALD II.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 04:49:58 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kwciylivcgwx76enpd747u7ozcl6yodrhi3dhq2p7b6xsho5g4vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 55848c2d1511ad7ff88d78ffcfd3eec897ec38713a3633c34ff87d791ddd372b

(this sample)

AgentTesla

Executable exe b9ba71cadb864e057d30e43853ab0496571740fa2dcb1f7f829ceb10413dcf21

  
Dropping
MD5 8ca3b460c83fed20751686a16f01ef1d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b9ba71cadb864e057d30e43853ab0496571740fa2dcb1f7f829ceb10413dcf21

Comments