MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79d51b7f84e94d21e7455de6dddecd74a9bd6854eed7f1e80edb44867b691a0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79d51b7f84e94d21e7455de6dddecd74a9bd6854eed7f1e80edb44867b691a0c
SHA3-384 hash: e5ac611bb4eaedf8ce4f08acc14aa862ac3d8ca20a235c4cabf71458b45731845f96e5b286a70ff9e6285f33e93937a8
SHA1 hash: 2f81ba8ef38c924955a4eb9fe99f8d5c457794ca
MD5 hash: fbf003cfdf5a2db282c0cb458a003166
humanhash: sixteen-oklahoma-arizona-beer
File name:lista di imballaggio e spedizione del contrassegno di spedizione.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:841'677 bytes
First seen:2020-05-22 09:26:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:sHwEuWCcYYijaxsr4Yv6BYvsvRUzJzJxW1+HufbjLZ:ctY9Oxsr43BbZizJVHurZ
TLSH 320533224E086088D3A8D9018B33573DA727644DFE305907DDAC7A71B28FCB7DE65AD5
Reporter abuse_ch
Tags:AgentTesla geo ITA zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: "milano.magazzino" <info@boeschboddenspies.com>
Subject: RI: lista di imballaggio e spedizione del contrassegno di spedizione
Attachment: lista di imballaggio e spedizione del contrassegno di spedizione.zip (contains "lista di imballaggio e spedizione del contrassegno di spedizione.exe")

AgentTesla SMTP exfil server:
smtp.dachanq.cc:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 09:36:05 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 79d51b7f84e94d21e7455de6dddecd74a9bd6854eed7f1e80edb44867b691a0c

(this sample)

AgentTesla

Executable exe d73ea1549286456543cc254f169516ea9524500f90d46a4d59c47174fcac88f4

  
Dropping
MD5 948b81b848b1aaaa9c7c9a88dbaf006e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d73ea1549286456543cc254f169516ea9524500f90d46a4d59c47174fcac88f4

Comments