MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d15c8ea1cc49a0c61ae5f26ae60555e4beb317e1099676723ee46609c48cd4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d15c8ea1cc49a0c61ae5f26ae60555e4beb317e1099676723ee46609c48cd4f
SHA3-384 hash: 638d41df13776dd89efa73651f06978fedacce0aa76a06af0d7746bda9ad98f5c9d9f5a9f8e8b86976b18838c72c851e
SHA1 hash: d1b613c99a68976a90fe34cad1280b9a6fd1b389
MD5 hash: 682a9ab0e97ac085fb38efdb22a1114d
humanhash: ceiling-kitten-iowa-rugby
File name:scan_06032020.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:408'788 bytes
First seen:2020-06-03 10:28:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:BozPq4gPAj2mwb2W4y/WqmwforssKkfUMRCQ6u8ZI:BozPWPAELxVgVKkFRC45
TLSH E99423D838A993F3E94003C4F9887BEA6D75319CE0038B4D8C7D9BAA350DD565C6D86B
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: akol.av.tr
Sending IP: 104.129.25.20
From: Jeenie Shin <goknil.ceylan@akol.av.tr>
Subject: Official quotation request
Attachment: scan_06032020.zip (contains "scan_06032020.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22739.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 10:36:32 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=luk4r2q4ysnayynol4tk4ycvlzf6wml6ccmwozzd5zdgbhcizvhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5d15c8ea1cc49a0c61ae5f26ae60555e4beb317e1099676723ee46609c48cd4f

(this sample)

AgentTesla

Executable exe 218eadf397c142440e7c54221a6faf836e512446e8d39b850114565b0ca36331

  
Dropping
MD5 094f1f206003875f93441537f93aed26
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 218eadf397c142440e7c54221a6faf836e512446e8d39b850114565b0ca36331

Comments