MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54e00d6889d2a18cb76ec52ce61bb4771b940b3cfbf360c4550250e4fb8a89f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54e00d6889d2a18cb76ec52ce61bb4771b940b3cfbf360c4550250e4fb8a89f8
SHA3-384 hash: 8b8ac6edd68d3f92aa619b5e9fec5c857c46e9de4b78edd1414be84d6368b520cfeaf2c8f84dcb22d014f963d116cc25
SHA1 hash: ce6a3d3ac98593a662fbb0b2584ed1b783aebb8a
MD5 hash: d3755cb95958be4cf7b2d824e61eba82
humanhash: oregon-autumn-berlin-twenty
File name:QUOTE 002242020 2.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:461'621 bytes
First seen:2020-05-06 10:56:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:0odc2Nzo1yng7NCedxWJDT2t1+LfAcNRSL4EWRuB2p5sXSjvy3gWPtRw0eD9Q6FH:hdc2gDypJrAWRSL4EWRuo8XST/iw0eBN
TLSH 8FA4231066B315C9F39A5482896E120349410BDD0CF2CBBF7C9874EFA4693FB6AD3E06
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: khusheim.com
Sending IP: 103.99.1.148
From: Mubeen Ur Rehman.K.K<proc29@khusheim.com>
Subject: RE:QUOTATION
Attachment: QUOTE 002242020 2.zip (contains "QUOTE 002242020 (2).exe")

AgentTesla SMTP exfil server:
mail.villanika.gr:587 (95.154.242.134)

AgentTesla SMTP exfil email address:
info@villanika.gr

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 06:47:59 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ktqa22ej2kqyzn3oyuwomg5uo4nzicz47pzwbrcvajioj64krh4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 54e00d6889d2a18cb76ec52ce61bb4771b940b3cfbf360c4550250e4fb8a89f8

(this sample)

AgentTesla

Executable exe e12e8d3c045eaf7bcf729f25e39ed21114088534fef748acb3c8e0d2423b45bc

  
Dropping
MD5 ad93a8a12bc8a3cc8f206566ea1e94bc
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e12e8d3c045eaf7bcf729f25e39ed21114088534fef748acb3c8e0d2423b45bc

Comments