MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 772599fcf2724b31d7e8015dc109370b0f19ef0ae78390f7c225f7e526664fb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 772599fcf2724b31d7e8015dc109370b0f19ef0ae78390f7c225f7e526664fb5
SHA3-384 hash: a2112dda6b53ee3eea66a320841726dcb81ef919dd85ef7054dc741e9480c559fe44e4df7cfc0338066c4c53468ca727
SHA1 hash: edf5df3151aceae79ea5459c405f390a12705077
MD5 hash: 4d14a8cefc8f3f7c2de14d79db1871bf
humanhash: sodium-nebraska-virginia-freddie
File name:New Request for Quotation.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:383'410 bytes
First seen:2020-05-11 14:42:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:1sXeC3PGIeVN7y7rnALzManOre6yXbUVjchNxqC0O1p3wvHNi5nuk7CBs5E1BNsU:1suC33eeXgrd62bUVIJ10O1d+HNi5uk6
TLSH F78423E3941EC4D7572F67E3D081D01E5AFBAA1F94211942B58D8D3A6F3A6D8C0ED980
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dns1.netikonsoft.com
Sending IP: 213.128.66.102
From: Alexander Karpov <info@artefes.com>
Subject: New Request For Quote
Attachment: New Request for Quotation.zip (contains "New Request for Quotation.exe")

AgentTesla SMTP exfil server:
mail.okgrocer.co.za:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.39844.7833.3348.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 13:59:47 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o4szt7hsojftdv7iafo4ccjxbmhrt3yk46bzb56cex36kjtgj62q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 772599fcf2724b31d7e8015dc109370b0f19ef0ae78390f7c225f7e526664fb5

(this sample)

AgentTesla

Executable exe 44c339f76dceed23e3bb1ec0ba2b8f7ae626877a46b50b197d3a03541cadfb0a

  
Dropping
MD5 45ea380f7cff0d5d4c529f2ae389bea0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 44c339f76dceed23e3bb1ec0ba2b8f7ae626877a46b50b197d3a03541cadfb0a

Comments