MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04dd2d4a2a5da93062f68148dd5897e72b97bfc0334d6218c7c8145bcae17b49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04dd2d4a2a5da93062f68148dd5897e72b97bfc0334d6218c7c8145bcae17b49
SHA3-384 hash: fec9d5bb12a5d0a0b8148be1c6126a77dc3fb8d57689824d914d4372657f6a149b0433671558ffdd5819c4033a095d40
SHA1 hash: 5979e2462c6193b5c1c589628f7f3ab96739344e
MD5 hash: 655ce56ae14597ace25eb47f78030eb9
humanhash: friend-oscar-sink-happy
File name:2020年中国（深圳）国际医疗防疫物资展览会(周文槟).z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:713'937 bytes
First seen:2020-08-27 05:43:58 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:x9geDIYI2Aek4XzP7TcPX1eSD9TkLH6cDmRPM48Zg19f4fL/os0syQqhEqgwUT6B:9DIcXO1eSD9Tk+jNzkHEs0FQ6/yTXk1n
TLSH 7CE4233D3090547C587F95AB8BE5C66A3ABCCD603AF929D2B52E1E334DD3ADD8810634
Reporter abuse_ch
Tags:AgentTesla CHN geo z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail-smail-vm37.hanmail.net
Sending IP: 203.133.180.225
From: 정동디씨 <jungdong2162@daum.net>
Subject: 8月7-8日2020深圳国际医疗防疫物资展剩余展位有限
Attachment: 2020年中国（深圳）国际医疗防疫物资展览会(周文槟).z (contains "2020年中国（深圳）国际医疗防疫物资展览会(周文槟).exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/04dd2d4a2a5da93062f68148dd5897e72b97bfc0334d6218c7c8145bcae17b49/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 05:45:07 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=atos2srklwutayxwqfen2wex44vzpp6agngwegghzakfxsxbpneq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/04dd2d4a2a5da93062f68148dd5897e72b97bfc0334d6218c7c8145bcae17b49

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 04dd2d4a2a5da93062f68148dd5897e72b97bfc0334d6218c7c8145bcae17b49

(this sample)

AgentTesla

Executable exe 2bff2eb9a8f7c497688208e9031adfc146bad406453325a3eeeb052f840e163f

  
Dropping
MD5 237cef094a2dee443dabf8969f23fb19
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2bff2eb9a8f7c497688208e9031adfc146bad406453325a3eeeb052f840e163f

Comments