MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5b8236b90f9893e283628da5fea78de02fc461cf96688ca1797b7715683de08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5b8236b90f9893e283628da5fea78de02fc461cf96688ca1797b7715683de08
SHA3-384 hash: 77a5e0035c0ac310e08e13c17d8fe118da595cb7b182072283a78eb6e2bfa854469a1b3e74bc9e0cb3221e042272dad7
SHA1 hash: 81d691099d067f2083091c5ea792659e40ba2a84
MD5 hash: aa0de92613af3fd1a269a248e79327e3
humanhash: venus-zulu-lima-finch
File name:Bulk Quotation for masks-20200647.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:574'703 bytes
First seen:2020-06-02 12:08:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:O/zCB5pKRp+VgF7vxRM4xc9+7tpigHE7O2sPvoygGjiP5NPa:O/W4+88z9+tMGj050
TLSH 89C423A419DE958B7F03A9327F3F7BE219321368857E3A3988C83411DB83BC7744A565
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx7.tianjinghk.space
Sending IP: 194.87.213.126
From: Wendy Zhao <wendyzhao@tianjinghk.space>
Subject: 3M 1856, KN95, N95 Quotation
Attachment: Bulk Quotation for masks-20200647.pdf.zip (contains "Quotation for masks20200647.pdf.exe")

AgentTesla SMTP exfil server:
superson-com.tk:25

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25518.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 12:37:29 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yw4cg24q7get4kbwfdnf72ty3ybpyrq47ftirsqxs63xcvud3yea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c5b8236b90f9893e283628da5fea78de02fc461cf96688ca1797b7715683de08

(this sample)

AgentTesla

Executable exe 59a1064718f625693e7b2a25911902db5ededa7758f8ecb2911ec36095ddb95a

  
Dropping
MD5 0845887038b72e7da5441f4d209a9a6e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 59a1064718f625693e7b2a25911902db5ededa7758f8ecb2911ec36095ddb95a

Comments