MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 65b89c429b971357162bfeb2981a77ea429b78f901dfc1bc9e41ee61df3fa58b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AgentTesla
Vendor detections: 3
| SHA256 hash: | 65b89c429b971357162bfeb2981a77ea429b78f901dfc1bc9e41ee61df3fa58b |
|---|---|
| SHA3-384 hash: | 73a4d032e0eaa999b0e3e76a7730e279c941f042d0a231e09cc33187fe74ed914a7e9121d15c8cca29d41987ae3d5563 |
| SHA1 hash: | fae04706b347088b2849a931203d5b9d460f8bf6 |
| MD5 hash: | 335450eeaf31a3bc22f25670afaf9397 |
| humanhash: | football-jupiter-xray-north |
| File name: | Non Woven Mask Order .exe |
| Download: | download sample |
| Signature | AgentTesla |
| File size: | 436'224 bytes |
| First seen: | 2020-05-01 11:33:03 UTC |
| Last seen: | 2020-05-01 13:03:23 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 6144:2qHoI3VBoJYsu39+zDN8korGANmOQooDiQGY0qPSb08l2E4YdYFViAE8CBkSgm:2XI3VBo839+/NlorGCmZHGO6og9GFDw |
| Threatray | 429 similar samples on MalwareBazaar |
| TLSH | F194012817548E17C69F04B8DC69CAB283F5E7D26C43FB169AD0E0B95E13F890611BBD |
| Reporter |  abuse_ch |
| Tags: | AgentTesla exe |
abuse_ch
Malspam distributing AgentTesla:HELO: qproxy3-pub.mail.unifiedlayer.com
Sending IP: 67.222.38.20
From: Polychroma s.r.o. <info@polychroma.cz>
Reply-To: harishguptmaya@gmail.com
Subject: Medical Mask; CHK-6678 - Non woven 3ply, SKF01 - Non woven 3ply, JC-201 - Non woven 3ply
Attachment: Non Woven Mask Order .rar (contains "Non Woven Mask Order .exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-05-01 04:52:35 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
27 of 31 (87.10%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 419 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.