MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2083ce7d4550ceaccac4b45679bfa5a9c8168adee4d7c79b7a6b566e597ddf9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2083ce7d4550ceaccac4b45679bfa5a9c8168adee4d7c79b7a6b566e597ddf9
SHA3-384 hash: 57d2dce48c8eeb3f3ed3aeb6dd44a0f1025338955e4e3806e6fdf04e1a742f48bef775de34008cbe17945d4501e15d05
SHA1 hash: 8a9436ae875d14d7d5dd53390e9132e92e0104ec
MD5 hash: dc421ca0185a51734748e38112923441
humanhash: apart-delta-low-mountain
File name:SOA APRIL.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:401'338 bytes
First seen:2020-05-27 08:33:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:hF/ATV13iZPibm0dxLSPuqoBs5VMidgxMRHv6JWfMYfa/hETzZGaBY+m:hF01lbh7SPKRiaxMRWYCmvI
TLSH 8584236D0C36D27223090FC82F48E1A7A6CBB55F1AEB618BB15CE7C27947852E0D5E47
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: "Sharon" <sharonliu-dlc@gotoubi.com>
Subject: SOA TILL END APRIL
Attachment: SOA APRIL.zip (contains "SOA APRIL.exe")

AgentTesla SMTP exfil server:
mail.tolipgoldenplaza.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WBK-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 08:37:18 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
9 of 48 (18.75%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b2083ce7d4550ceaccac4b45679bfa5a9c8168adee4d7c79b7a6b566e597ddf9

(this sample)

AgentTesla

Executable exe c57c75b73874a793db4640a20bf8f89c57d8b95c9165a721e3a71f5693127c49

  
Dropping
MD5 b4918de9ccfdf564a629cea7e3b82195
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c57c75b73874a793db4640a20bf8f89c57d8b95c9165a721e3a71f5693127c49

Comments