MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a98a9ee375a2143051dd55e2b3b891f088f20763b7f446b506f52178b28ed94a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a98a9ee375a2143051dd55e2b3b891f088f20763b7f446b506f52178b28ed94a
SHA3-384 hash: 65163b8909a552aa461b93fab7d8b6803bc3eb469cfeedc0df45321a454392b590dee1b133067031cc952a1f293a1981
SHA1 hash: 9b6b5e5dfcb12b946cb4a596ecd3d11187295e0c
MD5 hash: d2314bff490d1fe82bcfa9ccb14feaf6
humanhash: pasta-fruit-pennsylvania-angel
File name:P-O 632020.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:535'512 bytes
First seen:2020-06-03 08:27:51 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:u2Db9AjzJ7fYemzRtuAkFHLXb8i7gMwXGigCYcZhNA3lAivC5x7Rl3o:u2Db9i7fNczuh1LXAiDkNgBcZhTfPc
TLSH B2B4232189FF2D4B490339AAC4D3E8DF61F8D31E533F07A7A786BBD4D6212921B90650
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: immobiliere-trevi.com
Sending IP: 156.96.157.101
From: purchasing Manager <camusso@immobiliere-trevi.com>
Subject: WE ARE INTERESTED IN YOUR PRODUCT_ P-O 632020 (stay-safe)
Attachment: P-O 632020.gz (contains "P-O 632020.exe")

AgentTesla SMTP exfil server:
mail.kanzen.com.my:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 08:38:09 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vgfj5y3vuikdauo5kxrlhoer6cepeb3dw72ennig6uqxrmuo3ffa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz a98a9ee375a2143051dd55e2b3b891f088f20763b7f446b506f52178b28ed94a

(this sample)

AgentTesla

Executable exe d149b8b19b0a2841e483fb8e2671390b2073bba721dad0f24eeb0fbc23f4c954

  
Dropping
MD5 822be5b478bb8f850e41e9ff861ba07d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d149b8b19b0a2841e483fb8e2671390b2073bba721dad0f24eeb0fbc23f4c954

Comments