MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79690d4fb9d6c28644bb6ffaf431fb985b626ab681c857397e54c05ff221b46d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79690d4fb9d6c28644bb6ffaf431fb985b626ab681c857397e54c05ff221b46d
SHA3-384 hash: b3410d517a1e5397cfc0ba4ed1ec0996c67b9c1d148b9fc788429b8ee8a384aa0032714d5ff6feb8ef740337f1e54b42
SHA1 hash: 98d78010863348bfb9a0bf488cc3f4c77d28257e
MD5 hash: 82893a5afec0b0ebb54baf8f41e84985
humanhash: lima-social-seven-salami
File name:C38226 TD JMMasuda_Mfg.r01
Download: download sample
Signature AgentTesla
Create hunting rule
File size:814'875 bytes
First seen:2020-05-13 11:04:31 UTC
Last seen:2020-05-13 11:04:36 UTC
File type: r01
MIME type:application/x-rar
ssdeep 12288:yjndfl2MY0hLR9j0hb/6EpOyJwe8dfkoBCJ4GhEABKgi9Z30nG48eEFoNIGk4DEj:2RIMpN9j0wWJnLoBC3FBLaL48eEo3Eaq
TLSH 39053387F3C23947CF1056257B9E82332B55E064FE847DFA561D3EB6A3A2498D078623
Reporter abuse_ch
Tags:AgentTesla r01


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: outgoing8.cpt4.host-h.net
Sending IP: 197.189.247.41
From: Patryk Mazur <Patryk.Mazur@tkship.com>
Subject: RFQ Our Ref: C38226
Attachment: C38226 TD JMMasuda_Mfg.r01 (contains "[C38226] #TD JMMasuda_Mfg.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 22:20:21 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pfuq2t5z23bimrf3n75pimp3tbnwe2vwqhefool6ktaf74rbwrwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 79690d4fb9d6c28644bb6ffaf431fb985b626ab681c857397e54c05ff221b46d

(this sample)

AgentTesla

Executable exe fbc70395ea55477b8827145c12f85133565b1be20e31f71327ea17d2706127be

  
Dropping
MD5 6ca7ca71e6777e838bb32c911e5e68eb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fbc70395ea55477b8827145c12f85133565b1be20e31f71327ea17d2706127be

Comments