MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f3ac3c79c52f84444b25c1fa3b646262baba7eabd944c522f48a6bcb8f9b7c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f3ac3c79c52f84444b25c1fa3b646262baba7eabd944c522f48a6bcb8f9b7c3
SHA3-384 hash: 05396efa5c0b13fcf934222d57559d71de2009afd093caef5cde4a77171f6def860a0d5a7599da6d13639dfa7e222840
SHA1 hash: e0e2e73649313569d0788ead641fbb5f992b5fc0
MD5 hash: 1cba55c95d3e9024d8fa8867c9e97ce7
humanhash: beer-saturn-wyoming-fix
File name:AKT-ATTACHMENTS48484773.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:400'060 bytes
First seen:2020-06-11 05:54:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ghfihBrMKB4mTIJrUhWXV6wXY6U5c1B/fNflNo:g9cImWcx5+l9No
TLSH 688423ECDAE6F6F31ACACC33C38366C82963805F9528864A59C3416775EDDF096C7612
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pacmanccl.com
Sending IP: 185.234.219.109
From: Ahmed Zikri <info@pacmanccl.com>
Subject: URGENT PRODUCTS INQUIRY
Attachment: AKT-ATTACHMENTS48484773.zip (contains "AKT-ATTACHMENTS#48484773.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis88B93B2ACEA3.23876.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 05:56:14 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l45mhr44kl4eirfslqp2hnsgeyv2xj7kxwkeyurpjctlzohzw7bq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5f3ac3c79c52f84444b25c1fa3b646262baba7eabd944c522f48a6bcb8f9b7c3

(this sample)

AgentTesla

Executable exe 9124e3e221f0dab9e0a613d0baa87edc98b7646a7d9781131478e68027427bb4

  
Dropping
MD5 88b93b2acea3e67f5448a96c61c998df
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9124e3e221f0dab9e0a613d0baa87edc98b7646a7d9781131478e68027427bb4

Comments