MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5d1fe1e19e9a276f07538f76594ddc4c37ae7e656c16782b90c05fd548f1b96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5d1fe1e19e9a276f07538f76594ddc4c37ae7e656c16782b90c05fd548f1b96
SHA3-384 hash: 4c10470fb675287e717a29e0cb4cffab04c56367e32dc2fe679edb37b88786b53d2d0ae1259be404870304c7298ea976
SHA1 hash: d790fb65bfc19c45ccbc38225cf59bfe233df691
MD5 hash: 89ba137f6d4d09b399027c9987ace4d5
humanhash: saturn-ohio-skylark-bulldog
File name:File.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:401'241 bytes
First seen:2020-05-11 12:11:17 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 6144:M/lO0FzW9t/oGc8w4LiNTYI+xCWsfN4iYv5/m5nZen27ynwUmi+zUUydp43fsBqR:gsb/cvO6T+x0rYv5/m5Z7fU7+zFE4so
TLSH 038423075C7F349BEEDA3CF0C42A4B51D99BE2B4B5441DF4C59B8C2F7829CA892A444D
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx1.chaiyohosting.com
Sending IP: 58.181.206.8
From: Jeon, Kyung Seon <dlce303016@doosan.com>
Reply-To: bbkeIc@outlook.com
Subject: RFQ 자료 입니다-Doosan AWP39 Bidding: TH-ART-3C-AWP39-MEC-REQ-0006
Attachment: File.xz (contains "File.exe")

AgentTesla SMTP exfil server:
mail.tremdyclub.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 12:35:43 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2xi74hqz5grhn4dvhd3wlfg5ytbxvz7gk3awpavzbqc72vepdola._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

xz d5d1fe1e19e9a276f07538f76594ddc4c37ae7e656c16782b90c05fd548f1b96

(this sample)

AgentTesla

Executable exe 5bc296dfe287bdb6984000b8af4d8647fdcb42b22b521264e7ea14a74ac05975

  
Dropping
MD5 95fe5c95c4263b50ff6b6fd6cf2f6fec
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5bc296dfe287bdb6984000b8af4d8647fdcb42b22b521264e7ea14a74ac05975

Comments