MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1d2d07b93e683a49bd32642ae056a59afad8141653dc00110c32bcad24e5337. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1d2d07b93e683a49bd32642ae056a59afad8141653dc00110c32bcad24e5337
SHA3-384 hash: a76e205df9cf6953d52203cf7be506c4a87bcda743d82e2ada16b38db18721a31f7c3e4e403584961fcec3369cb04522
SHA1 hash: 774a7d7346c022f0f9e3d2df74b9f8bed44ff0bb
MD5 hash: 7f6e6c1343314f1f0e0e122c8af5fbf3
humanhash: mike-purple-hawaii-skylark
File name:enquiry- 20200501_-0019901002991.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:400'261 bytes
First seen:2020-06-01 08:06:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:3EwciGPHgYdQUDJcmPx9sPSy7UNh7/wItyOs:3EwcXFQMxPkS9H/OOs
TLSH 0D84234F418FEE116A7E7AD755EC4A14656180653CB1FBBAA7AE07834F0EE24D400ECA
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: kingfergroup.com
Sending IP: 193.29.187.182
From: jason Leung <jason@kingfergroup.com>
Subject: Enquiry for quote
Attachment: enquiry- 20200501_-0019901002991.z (contains "enquiry- 20200501_-0019901002991.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 08:36:38 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uhjna64t42b2jg6tezbk4blklgx23akbmu64aaiqymv4vusokm3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a1d2d07b93e683a49bd32642ae056a59afad8141653dc00110c32bcad24e5337

(this sample)

AgentTesla

Executable exe fcd30aa73d3d6d171ed813a1c766351a12696d975223faf6ba1053a17ccf1ac5

  
Dropping
MD5 553c7560f0b264c8ba781a8161e52527
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fcd30aa73d3d6d171ed813a1c766351a12696d975223faf6ba1053a17ccf1ac5

Comments