MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ea6ead642ef2511c707e35c00f763fffb8f150888ed92bf47527406aeee2534. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ea6ead642ef2511c707e35c00f763fffb8f150888ed92bf47527406aeee2534
SHA3-384 hash: bfa2592118c3a87984a498c5846ab6967c570829ef016f24449d2e5ea1bd9767c950b1e16dd890c79171e7122de3f2d2
SHA1 hash: 895ac501e529a05aef42c372f3f642625608f620
MD5 hash: c389a7c024d386e14b0026bcd5e2d715
humanhash: high-berlin-carolina-early
File name:ENQ REF-1024500508.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:381'901 bytes
First seen:2020-05-26 09:33:53 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:ul+/6nuodxes6qlfD1uWhKb12Mx8thrbdLOoLxQSMT5j/q3/dQ3j4p5:ultxehb5xYbdLOoLGpcsj4L
TLSH AA84235D1D6C88FA7A06F86342B9236539BF0B59C10DD20AD7F2C1B6B0A2DE95D88478
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gmail.com
Sending IP: 45.137.22.149
From: Mai <fasail.fmfashion@gmail.com>
Reply-To: Mai <fasail.fmfashion@gmail.com>
Subject: ENQ REF-1024500508
Attachment: ENQ REF-1024500508.cab (contains "ENQ REF-1024500508.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 09:18:44 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

cab 5ea6ead642ef2511c707e35c00f763fffb8f150888ed92bf47527406aeee2534

(this sample)

AgentTesla

Executable exe 1af39187ccacdf73f47da74611b9fb4582ca0d186cfedb27b557899a5eca6b9d

  
Dropping
MD5 a90af9f9664d2344500732c91dc03f03
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1af39187ccacdf73f47da74611b9fb4582ca0d186cfedb27b557899a5eca6b9d

Comments