MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 988dee6e5b7afde114a4a3834837079f2cbe56c38f21f1d2e3547c3991ca6ba4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 988dee6e5b7afde114a4a3834837079f2cbe56c38f21f1d2e3547c3991ca6ba4
SHA3-384 hash: 23dff59b16a3ad59b6c597e146834cc371b6bf49f3d9b65c08060a6c55644dca6c37da382066e2eaf69d54447739a3ae
SHA1 hash: caa413744d21dfd1b7b6aa849782f015166c66f5
MD5 hash: 585ecb134ddaec09ef6b3b92e2dfdadc
humanhash: oscar-lemon-mike-iowa
File name:Telegraphic Transfer.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:290'391 bytes
First seen:2020-06-01 12:27:14 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:3hkwBAxvybFdE4hA5p7aT2eZufAIrOylrIbM8EQfyUU8Tyv:3ywB6qFm5peKeZufAK7rIbntfTU8Tm
TLSH 595423E6167AF1019B3CF0056E565E4F7ABE162C027FF838D550BCB3970A59A4C43AE2
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email
From: "Richard Muizo" <richard.muizo@caspiexpress.com>
Received: from box.caspiexpress.com (box.caspiexpress.com [178.62.243.247])
Date: Mon, 01 Jun 2020 05:22:24 -0700
Subject: Payment Advice - [FMB0033110] / Priority Payment / Customer Ref:[XXXX339]
Attachment: Telegraphic Transfer.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 12:35:46 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 988dee6e5b7afde114a4a3834837079f2cbe56c38f21f1d2e3547c3991ca6ba4

(this sample)

AgentTesla

Executable exe 1bc624619190f4f4737d9041e58e297834dc6a26d063bb06a037fcb117390e0d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1bc624619190f4f4737d9041e58e297834dc6a26d063bb06a037fcb117390e0d

Comments