MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fae66341d559859c8282510c17a66db2cbfc5be1b7eac3cef11af65d4dc60c4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fae66341d559859c8282510c17a66db2cbfc5be1b7eac3cef11af65d4dc60c4e
SHA3-384 hash: 1bce98b7392138dbafb903b30314a35281bef3c60a3a0ab8872459c663b298f48167baec6f5daf31b4be484a85d9133a
SHA1 hash: b1b9d27f6f986984d32ed4488b73a289816c7f2d
MD5 hash: fc8c45a23f5c665235438b1258c940c6
humanhash: papa-diet-texas-michigan
File name:XIAMEN LONAKO INDUSTRY - products list.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:472'365 bytes
First seen:2020-06-29 07:26:23 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:QnDg/oi+U5IwBdusboOgnUI9O4JCeOGnXnRJWTBOLwe:QDg/i0Hus03JHOGnXncBOz
TLSH 4FA423458F614EACE81F80DDBF9A60354887A26879EEC0BC8F0AB5C748D79B155FD207
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: petrit.best
Sending IP: 104.129.0.123
From: XIAMEN LONAKO INDUSTRY <info@lonako.com>
Subject: DIRECT PURCHASE INQUIRY
Attachment: XIAMEN LONAKO INDUSTRY - products list.z (contains "XIAMEN LONAKO INDUSTRY - products list.exe")

AgentTesla SMTP exfil server:
mail.bmmarine.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fae66341d559859c8282510c17a66db2cbfc5be1b7eac3cef11af65d4dc60c4e/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 07:28:08 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ltggqovlgczzauckegbpjtnwlf7yw7bw7vmhtxrdl3f2togbrha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z fae66341d559859c8282510c17a66db2cbfc5be1b7eac3cef11af65d4dc60c4e

(this sample)

AgentTesla

Executable exe 90c26ff2c5f1b8d996cdb0088ffb03a076a261fbe8cf8717d7737f0bcacb439d

  
Dropping
MD5 c087e0f300e02002fecad4dfd09885d9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 90c26ff2c5f1b8d996cdb0088ffb03a076a261fbe8cf8717d7737f0bcacb439d

Comments