MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d67935690a5b19212da2674c83b4154bceda5324dd65f7c5986fd9cf29eea572. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d67935690a5b19212da2674c83b4154bceda5324dd65f7c5986fd9cf29eea572
SHA3-384 hash: fb8a2f6e2521884d2d079d29d724f6ae17822fc6db4f700628a2491abbcd44551a972de8dcc6e359405d022388d3b5c7
SHA1 hash: 27f9ce69e0e39f0fa71edbfb165895a7f182e929
MD5 hash: 42f754bf529ec170bb99f52030452082
humanhash: nevada-sodium-utah-washington
File name:INVOICE + PACKING LIST.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:489'986 bytes
First seen:2020-05-02 08:03:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:LxwvnVKGfI4CzmufmmpTvRPc/EaC0443M+:LavPI7au5RPcw43n
TLSH 64A43301488DDBA6E61CAB561A32F7D4FB59C1E42C55DF02608FE5A4123FD708B3DCA5
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: amhserver4.com
Sending IP: 85.214.43.178
From: Emrald sales <info@khirtacon-dz.com>
Subject: Re: DRAFT BL/ INVOICE + PACKING LIST
Attachment: INVOICE + PACKING LIST.zip (contains "INVOICE + PACKING LIST.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.jc.11884.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-02 08:35:50 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
21 of 48 (43.75%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2z4tk2iklmmsclncm5gihnavjphnuuze3vs7prmyn7m46kpouvza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d67935690a5b19212da2674c83b4154bceda5324dd65f7c5986fd9cf29eea572

(this sample)

AgentTesla

Executable exe 66d659af0fce5ee7b2787e527ae60c9aace938821572aaef05761916e055e69d

  
Dropping
MD5 d790806974579b39d05a8ac3ad12c242
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 66d659af0fce5ee7b2787e527ae60c9aace938821572aaef05761916e055e69d

Comments