MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 021167d25d1da6b03b476459604811deb5af5b77c69ba6238b67f85d92f0db4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 021167d25d1da6b03b476459604811deb5af5b77c69ba6238b67f85d92f0db4a
SHA3-384 hash: 9e87f69149a032cca1a7d89415cf644719046bf25ff13ac171de106d6fd7e52bae2b5f16aa0d0ea465027f957e45b431
SHA1 hash: 49c61a2cf0cd705fc98c15e501691d4f56261237
MD5 hash: f38ffab3cb06c2dc1f5a6246d417e198
humanhash: virginia-oranges-video-robert
File name:KOGAN AUSTRILIA LTD - Products Requirements.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:458'915 bytes
First seen:2020-05-13 06:10:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:V9js8MyLnKXxMlj0A8Meh0ZH2TMnzVuYZxZgS1:llnKXMXhdZH2TMnzw2ZH1
TLSH FCA4231981A1DF380CD4AAF4266DEDB12B5F1A60D03925867FC23D9117A2F4F25FBD21
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cpb2.medionline.cl
Sending IP: 45.55.49.33
From: Kogan for Business <commercial@kogan.com.au>
Reply-To: KOGAN HK LIMITED <konga.australia@aol.com>
Subject: Kogan Australia - Supply Enquiry
Attachment: KOGAN AUSTRILIA LTD - Products Requirements.zip (contains "KOGAN AUSTRILIA LTD - Products Requirements.exe")

AgentTesla SMTP exfil server:
premium101.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR.28515.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 04:07:02 UTC
File Type:
Binary (Archive)
Extracted files:
21
AV detection:
30 of 48 (62.50%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aiiwpus5dwtlao2hmrmwasar32226w3xy2n2mi4lm74f3exq3nfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 021167d25d1da6b03b476459604811deb5af5b77c69ba6238b67f85d92f0db4a

(this sample)

AgentTesla

Executable exe 481fe9b310d02dfed2c5d650e64b63bab9021d9c8ece0b90f9a0d474ce6d64e8

  
Dropping
MD5 67ff8238044496d3fcd0b57fc43720d9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 481fe9b310d02dfed2c5d650e64b63bab9021d9c8ece0b90f9a0d474ce6d64e8

Comments