MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed7cf9ac32d232ae495682610b66e694b76a526e0b3b2b56aab3e19f146d4ea2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed7cf9ac32d232ae495682610b66e694b76a526e0b3b2b56aab3e19f146d4ea2
SHA3-384 hash: 7a71712c1d091ab742001c9cac616e653a49089ff1f0303d9422dc8095839a4051091f6795c8553bf8ca2033267cb513
SHA1 hash: 5f7c9d92308a3c76fc3b4f5ca77a06bb021877d6
MD5 hash: 3706a2824369e363f10184958880a693
humanhash: red-twenty-paris-west
File name:C38226 TD JMMasuda_Mfg.r01
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'686'304 bytes
First seen:2020-05-11 15:19:36 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 49152:SYU1pbrMxiRJgt95nMKLLCCH4dtX9clMBIo9ZAgfn:Sr7rMuJs9qKHCCYdl9cyWo9aM
TLSH AF7533DBB9446A805F9FAF2BABA91D463DA82C93899F3D503058974B0B0077F03D71D9
Reporter abuse_ch
Tags:AgentTesla r01


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: outgoing28.jnb.host-h.net
Sending IP: 129.232.250.44
From: "Patryk Mazur" <Patryk.Mazur@tkship.com>
Subject: RFQ Our Ref: C38226
Attachment: C38226 TD JMMasuda_Mfg.r01 (contains "[C38226] #TD JMMasuda_Mfg.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 22:30:14 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5v6ptlbs2izk4skwqjqqwzxgss3wuutobm5swvvkwpqz6fdnj2ra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

r01 ed7cf9ac32d232ae495682610b66e694b76a526e0b3b2b56aab3e19f146d4ea2

(this sample)

AgentTesla

Executable exe a007c974d0e999a91fb8e3c81489642b608dee675c411d99baf42499c64cc1a8

  
Dropping
MD5 a526291ca95df6367cdb50d1adfd7a2c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a007c974d0e999a91fb8e3c81489642b608dee675c411d99baf42499c64cc1a8

Comments