MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b354dfaafe518cce65c4af8707ac70d82666374f04e14f675dab08beaa4adf9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b354dfaafe518cce65c4af8707ac70d82666374f04e14f675dab08beaa4adf9
SHA3-384 hash: ceea5e40d7b56ad0e0f2cae49ff90049fb8120f59a711437946fca3ce468391ba9b7edee113fa21619043e63b49cf7c0
SHA1 hash: 6ea700626610ab45e1be83367da672d572c8d38f
MD5 hash: aa4860ab296d56461ea25e04858dc658
humanhash: five-six-pip-missouri
File name:ENQUIRY_0W9_SPECIFICATION.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-12 08:06:34 UTC
Last seen:2020-05-12 08:13:17 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:8QCCV/so/+KIlNJFPKXRVLXf09dbe2F4P:BBB/GHJwHv09dbe2K
TLSH 8645E05672B8EE07C25E41FB805171220F7CAD9A9192F3CA3CD674E91FB57C20A41E9B
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dr.com
Sending IP: 193.169.52.159
From: Jessie <bors.lubing@dr.com>
Subject: Re: RE: Inquiry #637
Attachment: ENQUIRY_0W9_SPECIFICATION.IMG (contains "ENQUIRY_0W9_SPECIFICATION.exe")

AgentTesla C2:
http://193.169.52.202/image/images/news/tax/pictures/news/inc/28e4bee586d0b8.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR.19424.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 08:36:01 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
18 of 31 (58.06%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lm2u36vp4ummzzs4jl4ha6whbwbgmy3u6bhbj5tv3kyix2vevx4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 5b354dfaafe518cce65c4af8707ac70d82666374f04e14f675dab08beaa4adf9

(this sample)

AgentTesla

Executable exe eda02fbb1dc0c0fe2555b90f4073e05f821ff7ccc92547a669e19bd551dc7693

  
Dropping
MD5 f8820df2a261b087aae4b97881243ff5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eda02fbb1dc0c0fe2555b90f4073e05f821ff7ccc92547a669e19bd551dc7693

Comments