MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97449ed6301f8f1b608b9a741c31a6421bc368c760281765bde1162f1e305951. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 97449ed6301f8f1b608b9a741c31a6421bc368c760281765bde1162f1e305951
SHA3-384 hash: b7eadf6cc1e4b7b42cb521099609f8baeb0ee2039784978e4e5cc12738eb38c784bcf626629fa08f62c849b69e913c98
SHA1 hash: 4368214ffdcb5cf4726c5c68c46a54b696089ab3
MD5 hash: c7c39242ba57d9b90f8e29a6a6e1bc36
humanhash: cardinal-social-fourteen-fifteen
File name:shippment.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:501'712 bytes
First seen:2020-07-29 12:26:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:oRyxfKWLOHyyA3OOGz/XUySy98dfjT3ifBxGIaGxEjln/m486F:IyR/TyAePUy5AfjT0/GQWjF/m486F
TLSH 51B423D910A8C8153DBF2E395A3D65E27A12E87B97A07380B701E49158FD2CD7E40DFA
Reporter abuse_ch
Tags:AgentTesla DHL zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.vimsmail.com
Sending IP: 198.57.186.8
From: DHL Customer Support <support@dhl.com>
Reply-To: support@dhl.com
Subject: Fwd: DHL Shipment Clearance Notification 9617389880
Attachment: shippment.zip (contains "shippment.exe")

AgentTesla SMTP exfil server:
smtp.sidlewtex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/97449ed6301f8f1b608b9a741c31a6421bc368c760281765bde1162f1e305951/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 12:28:06 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s5cj5vrqd6hrwyeltj2bymngiin4g2ghmaubozn54elc6hrqlfiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/97449ed6301f8f1b608b9a741c31a6421bc368c760281765bde1162f1e305951

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 97449ed6301f8f1b608b9a741c31a6421bc368c760281765bde1162f1e305951

(this sample)

AgentTesla

Executable exe 5ca72f1b30267136dbe5f1bfea2782a2607e13eabdf78a30a1cba50c493fa1fb

  
Dropping
MD5 c2398839dc16e09fa2b1ffe7bee66f4a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5ca72f1b30267136dbe5f1bfea2782a2607e13eabdf78a30a1cba50c493fa1fb

Comments