MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 130b8a76b5b8129ec22f891bcabe5fc5832fab3efb060aed74aff4b93e32ffb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 130b8a76b5b8129ec22f891bcabe5fc5832fab3efb060aed74aff4b93e32ffb0
SHA3-384 hash: 28e0589cf73858f5695698c7c5cd4f13cd5c2bd30daf9c79ccd8bf0e2890b60c1436a5223a378df099512222d8ba4150
SHA1 hash: e16b816adb47e5c1770d10cfa2b08467105db89e
MD5 hash: f15f559528b634e9924dd95ab1b8f91d
humanhash: ink-monkey-cat-stream
File name:ORDER FORM.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:573'505 bytes
First seen:2020-05-29 05:26:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:fHUlpgqbSyWRRWvMvZ8xIBHn1Uw5Et6hS2zMt:f0lHbSyWRR6ed195E4RU
TLSH 17C4233EF9B200A23079339BA658C057D5A7B6A7934310594BE35EBE073BB359B05372
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: poydorus.t.mk
Sending IP: 195.26.152.36
From: kzk@kzk.gov.mk <kzk@kzk.gov.mk>
Subject: Fw:Reference: GOT / 731104 :: Inquiry
Attachment: ORDER FORM.cab (contains "ORDER FORM.exe")

AgentTesla SMTP exfil server:
mail.radiomeff.mk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-29 05:35:54 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
12 of 48 (25.00%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 130b8a76b5b8129ec22f891bcabe5fc5832fab3efb060aed74aff4b93e32ffb0

(this sample)

AgentTesla

Executable exe e9f0d843d20ec7dbba3f8e8e4a412d369d997b384a10762ccf02544738a39358

  
Dropping
MD5 37a660c8300e99ce319bfde8c34644f1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e9f0d843d20ec7dbba3f8e8e4a412d369d997b384a10762ccf02544738a39358

Comments