MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a19a61fac499bbbcb7ca34fa6ce436fef7096dfcadba07eb60249c003a027e41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a19a61fac499bbbcb7ca34fa6ce436fef7096dfcadba07eb60249c003a027e41
SHA3-384 hash: 5efe98797edf908484cffad735a46dd86eae230d3129855895ebc2ea9a30805b78aad2712e897375215bfbb1df49134e
SHA1 hash: 1f7bcab81ae3fc6f2d3358cfb195f1fe324b40bb
MD5 hash: f9c5b70fd1fb381995b7d296e10ca262
humanhash: wyoming-whiskey-mountain-three
File name:00 -116322741.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:361'440 bytes
First seen:2020-05-02 10:00:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:C4HMWTu0qZXLWlcvQcZ/ePA/sx1Us3iauRSnKISo8bGhc1KNQwGLYziOgyq9:CbUJSXLWyAPA/sjUHauRAShGhcUNhGEU
TLSH 73742347EA37C23BD0AD485CA2F5EA90E4C3E32D4EF0D8B31F45068C69E586D965D2C6
Reporter abuse_ch
Tags:AgentTesla MailChannels zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: brown.birch.relay.mailchannels.net
Sending IP: 23.83.209.23
From: xie@xpoi.xyz
Subject: RFQ:: Ref_00 - 116322741
Attachment: 00 -116322741.zip (contains "00 -116322741.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VRY.20913.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-02 10:35:45 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ugngd6wetg53zn6kgt5gzzbw733qs3p4vw5ap23aesoaaoqcpzaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a19a61fac499bbbcb7ca34fa6ce436fef7096dfcadba07eb60249c003a027e41

(this sample)

AgentTesla

Executable exe fef351d237d3cd331330624de2476bc9cf4aea538177800ac16521d0e9da3baf

  
Dropping
MD5 47e7783e10cb51b92e6b547f3830314f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fef351d237d3cd331330624de2476bc9cf4aea538177800ac16521d0e9da3baf

Comments