MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2bb71ce3627493076a6896cf99455be40c7a0ed452c11146abfa1e069ff6483. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2bb71ce3627493076a6896cf99455be40c7a0ed452c11146abfa1e069ff6483
SHA3-384 hash: 8f934a2111e72cf856103cc0fa74adb47bd7c90914aaaed5ae14e7ae0ae2a3841a3de4c5bc65a7a20f4e63a98dc17276
SHA1 hash: 357fc4c3a9fa3aba3834762013696180d4015fd8
MD5 hash: 4d55267b7c4736a978931399201b8713
humanhash: sad-princess-oranges-uncle
File name:Image001.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:387'409 bytes
First seen:2020-06-15 12:21:16 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:ct58HzA4tZ9N/9AQM0s+lyVOs/e/LLSUtKSVjGX05Vcch4HTci5sCplTyMeMXLQK:ckHhtZb/CQM0wEZ//ysGgrh4HTTxbTPP
TLSH 6D84234C05F3088631EE7488A6D3D76F251900E825C5EF35E37D8D48079925A7ABFA4F
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.bontechnologies.com
Sending IP: 46.4.133.15
From: Khaled El Rashid <khaled.rashid@readymixbeton.com>
Subject: Transfer
Attachment: Image001.gz (contains "Image001.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 12:23:08 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2k5xdtrwe5eta5vgrfwptfcvxzampihniuwbcfdkx6q6a2p7msbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz d2bb71ce3627493076a6896cf99455be40c7a0ed452c11146abfa1e069ff6483

(this sample)

AgentTesla

Executable exe 05ea9c58563a4b38dbc86c5be7ee0713a05657260b35ffba490a766c88baab96

  
Dropping
MD5 b27f96b5ebf8adafbf1fc9dc097fc43c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 05ea9c58563a4b38dbc86c5be7ee0713a05657260b35ffba490a766c88baab96

Comments