MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b318da0c01f05d0580af8811c6c9154b82516f20197d2df19bb402cc526f6d41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b318da0c01f05d0580af8811c6c9154b82516f20197d2df19bb402cc526f6d41
SHA3-384 hash: ac0f908c8f72cd9f6498ef3ec07d57f9c2bb78ba5593c0fc10778ce5bcf4ebf51d347ef92b2c4cb74a0d2c8277cb23b9
SHA1 hash: 86de058c69a14364e13b767b02f5f18a8af8c997
MD5 hash: ee68e2f057a3e3494fa15fcb25c08b24
humanhash: steak-uniform-ceiling-virginia
File name:Dragon Sourcing Co, Ltd - inquiry list.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:524'491 bytes
First seen:2020-05-11 08:12:11 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:IOaUIbFK6TcBUhjWjb3PJhmbPIL+DwKAzaC6y7JKKzRb/N:hwRK6TOkWjr2UL+UKM6yFKkRbl
TLSH 3DB4235873A22A81A6350363FB4447271CFE7DF40592AAC19DC6E65DDE30E637847B8C
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cpb2.medionline.cl
Sending IP: 45.55.49.33
From: Dragon Sourcing Co, Ltd. <nihao@dragonsourcing.com>
Subject: Dragon Sourcing Co, Ltd - Products Inquiry from our clients
Attachment: Dragon Sourcing Co, Ltd - inquiry list.z (contains "Dragon Sourcing Co, Ltd - inquiry list.exe")

AgentTesla SMTP exfil server:
premium101.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 08:36:49 UTC
File Type:
Binary (Archive)
Extracted files:
50
AV detection:
20 of 31 (64.52%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wmmnudab6boqlafprai4nsivjobfc3zadf6s34m3wqbmyutpnvaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z b318da0c01f05d0580af8811c6c9154b82516f20197d2df19bb402cc526f6d41

(this sample)

AgentTesla

Executable exe b9ec297e0d25daea9fb1436a9e123ef425506ff750098a1729b7dea67b77170e

  
Dropping
MD5 2e10bc8d37ee395713fe171a59ba53c3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b9ec297e0d25daea9fb1436a9e123ef425506ff750098a1729b7dea67b77170e

Comments