MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99d623f75a541bd87a9d583720ee08b02de86b85c8534c6d36cfd7345b4347da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99d623f75a541bd87a9d583720ee08b02de86b85c8534c6d36cfd7345b4347da
SHA3-384 hash: 6b58fbcd23f1a64f757c2718e847c394d6a78db0082f172c7cda4113956187f742b68fd2b22789cbcff7416787be0402
SHA1 hash: 1637860c3334c054c4e4f35d5de708871ad9ea56
MD5 hash: bd40f295fda4b533b9ed1fd0f514ba00
humanhash: green-zebra-monkey-november
File name:proformainvoice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:384'262 bytes
First seen:2020-05-19 14:27:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:5gWb3D/j0MMDvbNf+GrdjT9QqfjpC82GICcWFGFCVkj7g6h7NhHfiSOf5vz5veMf:aWb3DYfbNfFBj3I8XICctFCVW0l3XylY
TLSH FB8423DAAD61580166BF4998D9C4D760899512E836CBAFF714B5FE0E202FDF13328E34
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: divella.it
Sending IP: 23.254.247.78
From: Tianyu Shi <spedizioni@divella.it>
Subject: Re: NEW PRO-FORMA INVOICE
Attachment: proformainvoice.zip (contains "proformainvoice.exe")

AgentTesla SMTP exfil server:
atn-com.pw:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.47202.16224.17191.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 14:37:11 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=thlch522kqn5q6u5la3sb3qiwaw6q24fzbjuy3jwz7ltiw2di7na._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 99d623f75a541bd87a9d583720ee08b02de86b85c8534c6d36cfd7345b4347da

(this sample)

AgentTesla

Executable exe a55012ee806885f057a2317d3bf72f3b7e43a77c1d1d75f142b73676ec52c6c4

  
Dropping
MD5 972a096d897c2cce9887d32209f61959
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a55012ee806885f057a2317d3bf72f3b7e43a77c1d1d75f142b73676ec52c6c4

Comments