MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79092f23a261bfbeb3398707d48c1e5c230517d5258d3b82477450484a925577. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79092f23a261bfbeb3398707d48c1e5c230517d5258d3b82477450484a925577
SHA3-384 hash: cc081603b236c932dca106997b75bb5c08dc518b1186ba11b3f94969c935dd4b4f9d7bcab92a4a1c011b2a43321c0774
SHA1 hash: ae8d934c8b10b796a73edb294518942e36b1bb18
MD5 hash: 761a684e09f699bd8e130107a615acdd
humanhash: sad-bacon-william-speaker
File name:IMG_0009786R445TGUH.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'345 bytes
First seen:2020-05-13 07:12:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:O8lDHUXNC80OHLEHhpVov/iE3Xcsejyr4FBJ/y50v7BJ9rJheiO3MQhzm7gTF:QqOrEHhp6v/p3XcTyrY9yMZz+5hzYgTF
TLSH BA8423BA5D1B5A94CD1598D0169CBCD5FCCE2ACB8DCC08988A1F3DE5283584FF52E0E8
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cmp.com.ph
Sending IP: 45.11.19.32
From: Cem YÜRÜK <chyap@cmp.com.ph>
Subject: Re: U_R_G_ENT O_R-DER/ June/July Shipment
Attachment: IMG_0009786R445TGUH.zip (contains "IMG_0009786R445TGUH.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25676.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22989.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 07:36:55 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pees6i5cmg735mzzq4d5jda6lqrqkf6vewgtxashorieqsuskv3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 79092f23a261bfbeb3398707d48c1e5c230517d5258d3b82477450484a925577

(this sample)

AgentTesla

Executable exe 2b9ac04e330dd1d57544561da42bd8826c516e16b1acb6e70aa07d38f8152cde

  
Dropping
MD5 f6cec1316813848e64a78fe3d6d29386
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2b9ac04e330dd1d57544561da42bd8826c516e16b1acb6e70aa07d38f8152cde

Comments