MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5b9cfe75eb6a04fefe494b2840c956c82678fd4f76bf3092a3d1b3a14743209. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5b9cfe75eb6a04fefe494b2840c956c82678fd4f76bf3092a3d1b3a14743209
SHA3-384 hash: 002b780f25607307c05c2960da5d2f23200f823e2b94617a531f700bcfb76cb850515457f1c6574c7299138450ad8c63
SHA1 hash: 349dd3e39087f4efd96e2c22a4d2432585b09f67
MD5 hash: ab2245b07dfaf91975601015a6f1ab80
humanhash: kitten-helium-table-july
File name:20202105.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:556'821 bytes
First seen:2020-05-21 11:07:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:FVgNwEAMAxqtqYnRaYScNsF/WxSLuLiWdZwJVu0x+/F3:FyGQtdaYScNsFbum/VK/h
TLSH D0C423797954185C903C28738253E52005F415EAD3DEFB2EB8F3A2C9A725EF8937394A
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: host59.registrar-servers.com
Sending IP: 198.54.126.39
From: bizbond@bizbondbd.net
Subject: Fwd: Re: Re: Re: 26136 PI 20296629 SO 40129429 Order Balance Due
Attachment: 20202105.rar (contains "20202105.exe")

AgentTesla SMTP exfil server:
mail.mail15.cp247.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 11:37:16 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar e5b9cfe75eb6a04fefe494b2840c956c82678fd4f76bf3092a3d1b3a14743209

(this sample)

AgentTesla

Executable exe ddef618a8a5edbda2aad2dba2eac7de1d0f7a4e31cc4bebb9f2b6b4dd43d0174

  
Dropping
MD5 ed4258e4ca4dcf43f21bfe1c3552ebb9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ddef618a8a5edbda2aad2dba2eac7de1d0f7a4e31cc4bebb9f2b6b4dd43d0174

Comments