MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 953779de73c3bcb4215e41d0f06a29fcb4f0e6f5bfa77f97b958a7d4fe5d0a7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 953779de73c3bcb4215e41d0f06a29fcb4f0e6f5bfa77f97b958a7d4fe5d0a7d
SHA3-384 hash: 1e73b91be66c96823e350a5c8a9aa93b44cf2d23376b061e846c40d453a3c81434a2314f7ad391a6584455b8b3ba0b02
SHA1 hash: f7a1eb4f33837864079fe411542f2f1103cb396a
MD5 hash: 9a92e65b00f02a4a7613cc597c2a9185
humanhash: rugby-october-oregon-fish
File name:0012704658203.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:424'890 bytes
First seen:2020-08-14 08:19:49 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:b5I1LVDwkfoONdkMugYQrsKQcUT+RBhkq37EgO:b50VDwk7NdkMpZZQcUT+RUq3QgO
TLSH CE9423DBA3F25D1C317D7AF4AD95981F98AB88F10C689AD42BBB00C92509B2E4C0F55D
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: leagueshipping.com
Sending IP: 185.222.57.80
From: SUSIE <susiewang@leagueshipping.com>
Subject: 供应商申请--青岛航之辉国际物流有限公司（增加LEAGUE SHIPPING)
Attachment: 0012704658203.gz (contains "0012704658203.exe")

AgentTesla SMTP exfil server:
mail.hybridgroupco.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/953779de73c3bcb4215e41d0f06a29fcb4f0e6f5bfa77f97b958a7d4fe5d0a7d/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 08:21:07 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=su3xtxttyo6liik6ihipa2rj7s2pbzxvx6tx7f5zlct5j7s5bj6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/953779de73c3bcb4215e41d0f06a29fcb4f0e6f5bfa77f97b958a7d4fe5d0a7d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 953779de73c3bcb4215e41d0f06a29fcb4f0e6f5bfa77f97b958a7d4fe5d0a7d

(this sample)

AgentTesla

Executable exe 374da77f56a763236c07c8313f3702534043524af5dda3b5d084e127e0c6450b

  
Dropping
MD5 a12e112ad46dc4c42405b82a06164d3b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 374da77f56a763236c07c8313f3702534043524af5dda3b5d084e127e0c6450b

Comments