MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8dc9d028f4c433ee38e44af5040cdd6bb55d4b9b990a04c084622db368710404. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8dc9d028f4c433ee38e44af5040cdd6bb55d4b9b990a04c084622db368710404
SHA3-384 hash: 2aa8ab512937b319eeb49be1b6a4b9298abe21af1ef753a0ec3ec5cf1dddbaeb843568664f373151a719afc8ead65701
SHA1 hash: 5e048dc4f724b701bbc1162c8587c71a20ca9f38
MD5 hash: aa5e08fd3f6967b47c261f67c5f75c52
humanhash: fruit-texas-kansas-idaho
File name:AWB5305323204643,pdf.iso.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:404'887 bytes
First seen:2020-06-15 17:27:19 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:c6ywD1WHyMNObIMRxE5L0uwUpVEPquW/W6mSvov6:c9wJWHd5LaUrEPqueW6doC
TLSH FE84238B0DBBE1512213554AF7BFEC1CD743794A9BA94882861097FB39F1940E6B31F2
Reporter abuse_ch
Tags:AgentTesla FedEx z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: client-104-168-175-183.hostwindsdns.com
Sending IP: 104.168.175.183
From: FedEx <track@fedex.com>
Subject: FedEx's AWB#5305323204643 - Information is required
Attachment: AWB5305323204643,pdf.iso.z (contains "AWB#5305323204643,pdf.iso.exe")

AgentTesla SMTP exfil server:
smtp.vivaldi.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 17:29:04 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rxe5akhuyqz64ohejl2qidg5no2v2s43tefajqeemiw3g2draqca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 8dc9d028f4c433ee38e44af5040cdd6bb55d4b9b990a04c084622db368710404

(this sample)

AgentTesla

Executable exe 05d2a876ff034215c958e49dcfb4b7230c869bf646e7a72efe26b35bd0ab6ce3

  
Dropping
MD5 e78990ab515ff33eb54dca91716e8743
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 05d2a876ff034215c958e49dcfb4b7230c869bf646e7a72efe26b35bd0ab6ce3

Comments