MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed04af177ad1d92cb185b111fc72caf2d35a0502c26a508d12bf9be20adbc5d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed04af177ad1d92cb185b111fc72caf2d35a0502c26a508d12bf9be20adbc5d5
SHA3-384 hash: 0d29f373e7f77574a9e0c0949a6d30da3239bd5f689939140b010e432ecc404f58dee799fa532e07d5b6eee83bce3aad
SHA1 hash: 631f14878aa238f53523a207b133df252f4bc7d3
MD5 hash: b42a06e0fd32086f7d0f945ca6a0a29c
humanhash: avocado-carpet-xray-beryllium
File name:New Order.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:487'027 bytes
First seen:2020-04-27 13:56:33 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:PEigiVVB7yij4yX9UXzPmvAUv+4WKLZBHq/bPfVa6H:PE3cVcij4yXiXrsl+4WKf4H
TLSH FAA4233868CF68D44D5A7F17BC2243E8DB8CB9D92540980A8F5B36C1F0A196FC5B8DE4
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: Magda Mahmoud Amin Sabbour <contact@scientechnic.ae>
Received: from scientechnic.ae (unknown [5.79.121.91])
Date: 27 Apr 2020 06:49:06 -0700
Subject: RE: NEW ORDER ATTACHED
Attachment: New Order.gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-27 14:35:25 UTC
File Type:
Binary (Archive)
Extracted files:
94
AV detection:
18 of 30 (60.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5uck6f322hmszmmfwei7y4wk6ljvubicyjvfbdisx6n6ecw3yxkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ed04af177ad1d92cb185b111fc72caf2d35a0502c26a508d12bf9be20adbc5d5

(this sample)

AgentTesla

Executable exe 7a7ea4a20add0c6022d4e72fe7d7e5558230447a95e0fbaca75780c8f248a9c4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7a7ea4a20add0c6022d4e72fe7d7e5558230447a95e0fbaca75780c8f248a9c4

Comments