MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca38725aee7d2b8b8c15a466153387371d6081ec8ba51fdae36ef897c324e6bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca38725aee7d2b8b8c15a466153387371d6081ec8ba51fdae36ef897c324e6bd
SHA3-384 hash: 0530ccca3836620c66766cac6694a70484641594cdd9e9ec0a7ec5b117a308105eb9f527632214384e7e60e49dbb0b4a
SHA1 hash: 15cbc1abc96b884e6180c54a66f233669e426730
MD5 hash: 42789cffa7dbaeef60a310baf7582d92
humanhash: utah-sodium-xray-hot
File name:Agency appoinment letter.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:497'778 bytes
First seen:2020-05-26 07:05:10 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:3lvK7ngptoZP5q3iK7ikaqdN0k6xY0c4Z/bvG:Ns9Zo3iKWdANmlcaG
TLSH B1B4230EB10735F8D294ABCFD12DB2C559112E362AD904B286A1647846B67F0FF7B84D
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail0.514.drienimeoni.casa
Sending IP: 68.183.81.45
From: "Glory Shipping Marine Co., Ltd" <akhaltsikhe@sharm.ge>
Reply-To: thomas.wright2005@gmail.com
Subject: Agency appoinment letter MT.Sinar Maluku V.04/20
Attachment: Agency appoinment letter.rar (contains "Agency appoinment letter.exe")

AgentTesla SMTP exfil server:
mail.gopaldasvisram.com:587

AgentTesla SMTP exfil email address:
prashant@gopaldasvisram.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 07:36:32 UTC
File Type:
Binary (Archive)
Extracted files:
25
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ca38725aee7d2b8b8c15a466153387371d6081ec8ba51fdae36ef897c324e6bd

(this sample)

AgentTesla

Executable exe e40a47b2463779b1d14af4a6611e560112de0ac5b926fe4fa5cbc36219e6ef7d

  
Dropping
MD5 74a28cf36b1216fb5f89e76c2a5d84f5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e40a47b2463779b1d14af4a6611e560112de0ac5b926fe4fa5cbc36219e6ef7d

Comments