MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79e9c21c5f5b430e248a3ddd739a76b97874a9057418f83416edc303e4275979. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79e9c21c5f5b430e248a3ddd739a76b97874a9057418f83416edc303e4275979
SHA3-384 hash: 55e549ac08398abf8643546174068d9b1f8bb70fe0e68da08017ce7ce58c7c79d4eaa16dbd02e66ed5664a6a3f08431c
SHA1 hash: 3dc9a521321c64cc68a52e878a03d67ebd1ebe0a
MD5 hash: 3a5ba8eacb16363741977877de624c53
humanhash: april-item-ack-table
File name:NEW PO -060746E7.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:398'136 bytes
First seen:2020-05-13 06:17:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:7aIu02OiGnj5bP88dOrJnf2pSl+i1a6JPsROqLUZ:7Lu/i5kJn5lZ10RORZ
TLSH D584236B5302A123B99F82CE78D6F4A7DD810425A663E985188FD270B7DF2528DF0D87
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: jhl-shipping.com
Sending IP: 103.99.1.173
From: Nishant Rajeev<sunnyguan@jhl-shipping.com>
Subject: RE:PO - RFQ # 097663899 NEW ORDER
Attachment: NEW PO -060746E7.zip (contains "NEW PO -060746E7.exe")

AgentTesla SMTP exfil server:
desguacespalomino.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR.21488.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 11:13:05 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
19 of 31 (61.29%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=phu4ehc7lnbq4jekhxoxhgtwxf4hjkifoqmpqnaw5xbqhzbhlf4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 79e9c21c5f5b430e248a3ddd739a76b97874a9057418f83416edc303e4275979

(this sample)

AgentTesla

Executable exe 2b969d8cdb8ebab56e42e08200126ecf287e3ce31245f7fb8563245cc53615de

  
Dropping
MD5 1ce79c86bde0daf6fcebb4f81228c118
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2b969d8cdb8ebab56e42e08200126ecf287e3ce31245f7fb8563245cc53615de

Comments