MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 199f5c3379f3268daedc5f3b3a36383bf171511d0d657fac4057b9e3b40619c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 199f5c3379f3268daedc5f3b3a36383bf171511d0d657fac4057b9e3b40619c7
SHA3-384 hash: 3cd19c1112c80fd616e4f0a3e7137bd071d9c2e7f504705f04f5883ab77459c795c9c370ed4620c02bcdd375b87cd2d9
SHA1 hash: 50c386223ff4e8cc02d0ecaa8870a250dd22152a
MD5 hash: e2de50c11994aea9616539df22138f4a
humanhash: six-bluebird-lemon-carolina
File name:Attachments.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:539'048 bytes
First seen:2020-05-05 10:15:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:kyAFOM+540h4LUcwnuz4PqUa6ET0Aqsplied8JVmu:kyAFOMg3h4SnuzeNET0oqh
TLSH 24B423B4F47C5A2E774C6439ED8C6BC961ADE08F1C0CAD0C5ED858A0B6632E4E774786
Reporter abuse_ch
Tags:AgentTesla HSBC zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hsbc.com.hk
Sending IP: 103.207.38.237
From: HSBC Direct Advice <commercialbanking@hsbc.com.hk>
Subject: Direct Advice-23APR2020 ART MAP, DE15628031
Attachment: Attachments.zip (contains "Direct_advice.exe")

AgentTesla SMTP exfil server:
smtp.israelagroconsultant.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic-S.27623.11243.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 10:36:22 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
20 of 31 (64.52%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dgpvym3z6mti3lw4l45tunryhpyxcui5bvsx7lcak646hnagdhdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 199f5c3379f3268daedc5f3b3a36383bf171511d0d657fac4057b9e3b40619c7

(this sample)

AgentTesla

Executable exe bd798dda71e760acc62a228c3c770034e1a5d0f65db0e0805a6157bcd8c9c454

  
Dropping
MD5 bf98feb3502d7f0914c6a1068a1bc9b1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd798dda71e760acc62a228c3c770034e1a5d0f65db0e0805a6157bcd8c9c454

Comments