MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a50c7653f706c9cee1b03c8b95ff85651bce5091dde59ee03278488b19193797. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a50c7653f706c9cee1b03c8b95ff85651bce5091dde59ee03278488b19193797
SHA3-384 hash: 1ffccd69108dc3ab574946d74e1eacad347a898c0c5b2fd214fe4754c84c0f084f2f080c3ec233cb450909b22d5d86ba
SHA1 hash: 00b7e33d504455ed6bf6077938a82a2a5e6eb0f1
MD5 hash: 2337ca1844ae6d865274a70d259be84e
humanhash: lion-juliet-gee-cold
File name:INVOICE 30394.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:522'662 bytes
First seen:2020-04-30 12:10:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:+UCK+iIRqfame4uXzAJLlWLDm+1i7B9L0+IAu2kcNL4uGZ:+UCKQUfafrGLlCA85cNL4V
TLSH 0EB4233396453121DE609D70475924DDEEE36890BFA2C2BEFC5AF6F81A4EC07982E149
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx.greentelekom.com
Sending IP: 178.211.39.11
From: Dionne Croughs <kompozitimalat@eraycephe.com>
Subject: REMINDER FOR OVERDUE INVOICES
Attachment: INVOICE 30394.zip (contains "INVOICE 30394.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 12:37:11 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uughmu7xa3e45ynqhsfzl74fmun44uer3xsz5ybspbeiwgizg6lq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a50c7653f706c9cee1b03c8b95ff85651bce5091dde59ee03278488b19193797

(this sample)

AgentTesla

Executable exe ff39d5481f489cbb3d09f5377d437b6d65b137f6616b3439846a617d924649f6

  
Dropping
MD5 684698af5c81e75aee6be5383ef21f46
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ff39d5481f489cbb3d09f5377d437b6d65b137f6616b3439846a617d924649f6

Comments