MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 225ea45868ad5881986d4ecce3d4576f6aa79799f62a78be36b29fdce573f54d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 225ea45868ad5881986d4ecce3d4576f6aa79799f62a78be36b29fdce573f54d
SHA3-384 hash: 3ce39ed294065943cbb38f43499dc362fad1a534dad2d5444479188525e10954ae8390e3c574290c5f4813cf6a858ad7
SHA1 hash: 8dc8bdc967d80c8476516bb603d85e9dac23e014
MD5 hash: 700682bbec922c96f8d91c1fe941a92c
humanhash: nineteen-leopard-tango-utah
File name:Shipment Notification.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:316'217 bytes
First seen:2020-08-31 05:45:49 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:fllMLCRRl+0WZPYn7YZv3GzU+FGJ03DMGO0h2jZggKmQ4EzgkAT7rcZi:LMLa/+0WZQn7Ab+FGTGlhdSxE8kAT7r1
TLSH B16423C1B22142373A3B397B5EC7B43995DCBC4205E8EF24DAEA84BA179F515AE77010
Reporter abuse_ch
Tags:AgentTesla DHL gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ew0.706.maxzizo.ml
Sending IP: 164.90.213.113
From: DHL EXPRESS <info@706.maxzizo.ml>
Reply-To: katharina.daehn@enserv.org
Subject: DHL Shipment Notification
Attachment: Shipment Notification.gz (contains "Shipment Notification.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.3065.11922.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/225ea45868ad5881986d4ecce3d4576f6aa79799f62a78be36b29fdce573f54d/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-30 23:00:17 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ejpkiwdivvmidgdnj3gohvcxn5vkpf4z6yvhrprwwkp5zzlt6vgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/225ea45868ad5881986d4ecce3d4576f6aa79799f62a78be36b29fdce573f54d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 225ea45868ad5881986d4ecce3d4576f6aa79799f62a78be36b29fdce573f54d

(this sample)

AgentTesla

Executable exe 6b5f4379addadad8b1e36688cc5902bc8488ac88d3d7390924a6565cf78a3ae9

  
Dropping
MD5 9bffa63afc3a3ad7e431037a5cad485b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6b5f4379addadad8b1e36688cc5902bc8488ac88d3d7390924a6565cf78a3ae9

Comments