MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f84b50073f99dbd5d770e9de241c117b83a81c04f855b82c63eb62df1c51e3df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f84b50073f99dbd5d770e9de241c117b83a81c04f855b82c63eb62df1c51e3df
SHA3-384 hash: 6d844d918c87cc7eda6686340d7722396c7384fa2b0957079524b2304ee1b752ef91795aae3c7f789ae83d9ef6f79cc2
SHA1 hash: 354aa5678f9625392f2f674f7fe927675ef0a242
MD5 hash: ea4f7622c81e262d7ef6332d0949e791
humanhash: four-seven-artist-fillet
File name:ShippersCargo_CH05212022SH.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:518'209 bytes
First seen:2020-05-21 10:05:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:hEFXaOv02Svr7yics7xkynwsKzvZY7uJN5:ibhSvreiD7G8t77uv5
TLSH 8CB423FF6C1B7B94D492DB7C90283A50FE83E542E879C0545333ADB6663A604A0D78E7
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: plesk5.etllao.com
Sending IP: 202.62.107.252
From: Chenyao <Hengpei> <kdps@e-kdps.com>
Subject: TOP URGENT: OC:CH/3126/0521SH <PLS ASSIST> Shanghai Onebox-repaired Cargo
Attachment: ShippersCargo_CH05212022SH.zip (contains "ShippersCargo_CH05212022SH.exe")

AgentTesla SMTP exfil server:
mail.karmachalets.co.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.SpyBotNET.17.10125.17317.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 10:37:21 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7bfvabz7thn5lv3q5hpciharpob2qhae7bk3qldd5nrn6hcr4ppq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f84b50073f99dbd5d770e9de241c117b83a81c04f855b82c63eb62df1c51e3df

(this sample)

AgentTesla

Executable exe beaa5c13b3a73673a51f0cf8a2c24ef5ec65c3bbe0007520d4af6c37a8d43aca

  
Dropping
MD5 20aad442210b535878e3eef30eaf8a61
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 beaa5c13b3a73673a51f0cf8a2c24ef5ec65c3bbe0007520d4af6c37a8d43aca

Comments