MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9e657ad61aac62271e5bab6f366cccf52dedcfe5045a77883b0b05cea27d84b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9e657ad61aac62271e5bab6f366cccf52dedcfe5045a77883b0b05cea27d84b
SHA3-384 hash: 90dc74295f14a40943493c700c955ee90b1516fcd4a237f9fc4416f5d30ac233e0704cee29d06eacc53c4079e1df3069
SHA1 hash: 9dc5e4f141a0da233bc8f39ad9c978f4775e6a39
MD5 hash: 98cdf7e12040ae8cf4f05b7d8b445f54
humanhash: mike-autumn-indigo-maine
File name:specification.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:415'015 bytes
First seen:2020-05-28 16:50:40 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:uvyc4eZU84EWL2WTKxlpLn5jpRNLjheLcyEPdDbZcVyCi5B86IL9jBAVW474CnGo:6rZPWL12xDrLocD2SO9juWknXb
TLSH 5D9423D46FE27FCA07CC78192B5D97091ADB7E519B20CCB41085770954E8A25E7AF83C
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: shbc10.ultina.jp
Sending IP: 218.40.207.10
From: Camilla Gallinaro <zhaojun@cetjd.com>
Reply-To: rgussy@ymail.com
Subject: INQUIRY
Attachment: specification.gz (contains "Image.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 17:36:30 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz b9e657ad61aac62271e5bab6f366cccf52dedcfe5045a77883b0b05cea27d84b

(this sample)

AgentTesla

Executable exe 4692f4e0ec2163456ca3eb3a20625b55a31601e00b35f2ac96ecadc927ae3969

  
Dropping
MD5 3f298f73944083913be6602ad5b99ab8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4692f4e0ec2163456ca3eb3a20625b55a31601e00b35f2ac96ecadc927ae3969

Comments