MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d53772249e8c4bdc41e56286caec38db15166b039f3e1e26a41f917fce197f0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d53772249e8c4bdc41e56286caec38db15166b039f3e1e26a41f917fce197f0c
SHA3-384 hash: a3c4306e5e9801725b6eb187a0d20cf7b20116a626c5fd4dfc99e31dc013b2da8763ca745839ad0b55cd991be755118e
SHA1 hash: 5f7d733e12231159e92aa14f2a65e784a7794adc
MD5 hash: c625fee48c635366f67310859a18bebc
humanhash: delaware-maryland-west-washington
File name:PO16254430053441.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:351'793 bytes
First seen:2020-07-16 18:48:56 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:pbrsxoOwdx7CHZI81wjzGKnqGqqotQopf23i8ClHiYEN5ogr1v0d:2Z4iI7+KdqqBc2jC5iYEN5ogpv0d
TLSH 6C742333D87CF889D16B089F16C10D6926587640E16DB0E60B78DCEFA48E8B14A4BFDD
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns12.iraq-dns.com
Sending IP: 185.52.101.73
From: Maria <info@noc.oil.gov.iq>
Reply-To: info@noc.oil.gov.iq
Subject: Our New Purchase
Attachment: PO16254430053441.gz (contains "PO16254430053441.exe")

AgentTesla FTP exfil server:
ftp.takumacakrajaya.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.31435.18448.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d53772249e8c4bdc41e56286caec38db15166b039f3e1e26a41f917fce197f0c/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 18:50:07 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2u3xeje6rrf5yqpfmkdmv3by3mkrm2ydt47b4jved6ix7tqzp4ga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz d53772249e8c4bdc41e56286caec38db15166b039f3e1e26a41f917fce197f0c

(this sample)

AgentTesla

Executable exe 24c4b4da9b6d215fc8a3fd32f9ce8873b37facf1b85b36b8333a441cfa469412

  
Dropping
MD5 11e07ccbedc5d38c3473de0dae107f4a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 24c4b4da9b6d215fc8a3fd32f9ce8873b37facf1b85b36b8333a441cfa469412

Comments