MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d68baf3856262c11a2e43ff4c402d94ec1c9c5ef2720e77e7f4b10f71b5dad8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d68baf3856262c11a2e43ff4c402d94ec1c9c5ef2720e77e7f4b10f71b5dad8a
SHA3-384 hash: 6430edfe8dc490ae0c86da29790f16e44555ea6310e24c8dbbf50b7a252062910eca199df1d9f5b597613ba1853632c6
SHA1 hash: 053aa06a03c9cb517a0e4a7fa1516bbe8bcb0179
MD5 hash: d23eb3c56245bed222a15d06b54d67da
humanhash: may-tennis-romeo-potato
File name:Inquiry 1703.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:390'165 bytes
First seen:2020-05-13 06:24:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:MednhS08B21vnewAquaRbit5xP+7FVesyUO1XIZ05lT:MeVhSuEwAquJxPGFVGI4lT
TLSH A7842382FA5A47F7F80D95DA429C81CD58215623FF59A0929378E0986F2E0D673FF2C4
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: beadsmart.ca
Sending IP: 185.144.29.196
From: info@beadsmart.ca
Subject: PO Ontario 6603
Attachment: Inquiry 1703.zip (contains "Inquiry 1703.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisDFC561376AC2.2964.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 06:37:18 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
27 of 48 (56.25%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=22f26ocweywbdixeh72miawzj3a4trppe4qoo7t7jmipog25vwfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d68baf3856262c11a2e43ff4c402d94ec1c9c5ef2720e77e7f4b10f71b5dad8a

(this sample)

AgentTesla

Executable exe 9a86a7d4ca6381d727287f79cd2f48fb6f6b1d88635f1c3cf00f0bd02236d49e

  
Dropping
MD5 dfc561376ac2261e13a9d6eb4cfb786f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9a86a7d4ca6381d727287f79cd2f48fb6f6b1d88635f1c3cf00f0bd02236d49e

Comments