MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79f77efd11243b6356bfe9114bd5bcb01dd0f23c61e411d816faa7d04d43c5a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79f77efd11243b6356bfe9114bd5bcb01dd0f23c61e411d816faa7d04d43c5a6
SHA3-384 hash: 7c9259df50d4a44279a765614f3bfbb8699d074bc664faf7bb89ada796004339219dfaf7a3c8943434f8ff1f02dd9ffc
SHA1 hash: 86934c75af9f044e1ff64c24f3986f53f2866989
MD5 hash: 956c2af3a71f7cf03ab9aa23fe522ab3
humanhash: hydrogen-march-freddie-winner
File name:Original Invoice.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:409'140 bytes
First seen:2020-05-29 05:24:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:BQoN2RRU/MNovgtlXFzFflLbCWWYCF78CE05/ntyqZvGvLHbWDwYiYPb4p0mTjeR:BF2LdrlLblW56A7v0bYujeewKQ7oxYD
TLSH 3E9423D0CD0A8862CDCE5F79070E06277445F664E227B66461D7A9CACB4B248F1FBF89
Reporter abuse_ch
Tags:AgentTesla gz TNT


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail0.709.dlvtminio.casa
Sending IP: 167.71.75.159
From: TNT EXPRESS <service@tnt.com>
Subject: TNT SHIPMENT ALERT
Attachment: Original Invoice.gz (contains "Original Invoice.exe")

AgentTesla SMTP exfil server:
mail.flood-protection.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.882755.12835.9899.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-29 04:08:51 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 79f77efd11243b6356bfe9114bd5bcb01dd0f23c61e411d816faa7d04d43c5a6

(this sample)

AgentTesla

Executable exe ca89978c4c1a8f2332ddda3773722086c23138fc7ce1a8f8a85962c5d40de583

  
Dropping
MD5 d0bd64075c1c15ad73c68834c21833ee
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ca89978c4c1a8f2332ddda3773722086c23138fc7ce1a8f8a85962c5d40de583

Comments