MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5128ec1a5ddd1a78a85d99c4a00e71291b99020bd02af69ef9e96ced5abb05eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5128ec1a5ddd1a78a85d99c4a00e71291b99020bd02af69ef9e96ced5abb05eb
SHA3-384 hash: e622f17b048dec99569dd6538e3da0ddb661cdcce72b2643f0ae2ad52cc4964068e0eecab43a2fd6f3bece4230e318e5
SHA1 hash: c90b0a6356b17b99f2f3c0efdf0b7f01223100bb
MD5 hash: d6174434730af23b61d2a2bd4f22d201
humanhash: july-hot-bluebird-north
File name:Quotation-03062020.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:330'455 bytes
First seen:2020-06-03 07:52:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:a8Qa/L2ZcJ8prxvhPUiUsF4rA45MpXc8p0VLh43rEr6nG9DbGTgr8v/:fQa/IcJ8prdhM+F4rA45ucFVmbE662gC
TLSH E76423C29FF6AFE7D425A78193381146E0B1A927E1CC08EC391D53D849621F7A9ED84F
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pacnuts.info
Sending IP: 51.81.254.67
From: priyanka.pore@external.merckgroup.com
Subject: Merck -QUOTATION-RFQ06022020
Attachment: Quotation-03062020.rar (contains "dave.exe")

AgentTesla C2:
http://gnicgy.info/dave/inc/a172e08be82357.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 00:00:00 UTC
AV detection:
13 of 31 (41.94%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=keuoygs53unhrkc5thckadtrfenzsaql2avpnhxz5fwo2wv3axvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 5128ec1a5ddd1a78a85d99c4a00e71291b99020bd02af69ef9e96ced5abb05eb

(this sample)

AgentTesla

Executable exe b4e82e572217937fb6fb66cc5f4761b3220e1c112daa4c7a9277bb871f455967

  
Dropping
MD5 75cb5526aa73d44a3dfa85c93ed022af
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b4e82e572217937fb6fb66cc5f4761b3220e1c112daa4c7a9277bb871f455967

Comments