MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b5305fa25809bc68b5acb4cf1cbf84f11fcece004c0a9487a17958629a89e7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b5305fa25809bc68b5acb4cf1cbf84f11fcece004c0a9487a17958629a89e7e
SHA3-384 hash: e9ccec1477399a837c4e599c163bdd0fb04d73a9e61d8de04201d68b6bb030d62b55916c1dfd8cfc3a1e126a5afc2e92
SHA1 hash: fdc492e9f7b84b0a07d5fc89ccd9c35cf35289b3
MD5 hash: c387773fe84fb1d8e5540d14eb8cecc6
humanhash: carbon-tennessee-shade-carbon
File name:Quotation list 202006070089_doc.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:396'290 bytes
First seen:2020-06-08 05:07:41 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:pqSOGTCCNisjAwI7KDj4TJPhXPz2uNNcSYUrH:0SO0zA77ciJPhXP5NJ
TLSH E384239FCB5529EC38312977857C544218437F99AE9BCCAE488636DF4EC90C713BE486
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lif.lifecare.com.my
Sending IP: 198.20.247.243
From: Paul Harbey <yangi@ryugakusite.biz>
Subject: REQUEST FOR QUOTATION
Attachment: Quotation list 202006070089_doc.gz (contains "Quotation list 202006070089_doc.exe")

AgentTesla SMTP exfil server:
smtp.anding-tw.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodGzip-A.11414.27266.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 05:09:05 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jnjql6rfqcn4nc22zngpds7yj4i7z3haatakssd2c6kymknitz7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 4b5305fa25809bc68b5acb4cf1cbf84f11fcece004c0a9487a17958629a89e7e

(this sample)

AgentTesla

Executable exe 8aad38614627972f2d27adc9e0a998ba52c55700c37e70da79f9240ed8b3605d

  
Dropping
MD5 51484024d193248a18ea77fba933144e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8aad38614627972f2d27adc9e0a998ba52c55700c37e70da79f9240ed8b3605d

Comments