MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55326c11cf1e5960b4b724af2e9be2d3e7d61f0f469a115d6b7c569911555de9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55326c11cf1e5960b4b724af2e9be2d3e7d61f0f469a115d6b7c569911555de9
SHA3-384 hash: 5c920af46d1c2f7f403e2377c6bd31e402df26d4d6d47520fbc17f7c5e6c9b0be4a7eb2bdb6b9d2180926ab6e6489680
SHA1 hash: 02468da520dd4f47b31dab126d5484748682f084
MD5 hash: 750b208b2ceb261962f8b51cd7251f5f
humanhash: west-aspen-pluto-cola
File name:URGENT QUOTATION.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:455'228 bytes
First seen:2020-07-28 13:46:22 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:5AVsdXnEdES/1b91MVzD6d7rPEAvRiTLf+:qeSiY1b91w6RrP3Mi
TLSH EDA423C7E9D1D0D5D7B03DF5C2FC9AAD3A61999D6FB012018358CF9469208FA3493279
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: Richard <orscorp@cyber.net.pk>
Subject: RE:URGENT QUOTATION
Attachment: URGENT QUOTATION.zip (contains "URGENT QUOTATION.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.52692.24577.7863.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/55326c11cf1e5960b4b724af2e9be2d3e7d61f0f469a115d6b7c569911555de9/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-28 13:48:09 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kuzgyeopdzmwbnfxesxs5g7c2pt5mhypi2nbcxllprljsekvlxuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/55326c11cf1e5960b4b724af2e9be2d3e7d61f0f469a115d6b7c569911555de9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 55326c11cf1e5960b4b724af2e9be2d3e7d61f0f469a115d6b7c569911555de9

(this sample)

AgentTesla

Executable exe 150d964fbfa64a31d6d9846500d2353e2aab67c7664cd222244c8e97c8e24b95

  
Dropping
MD5 203695345c45125e54608c6aed247b88
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 150d964fbfa64a31d6d9846500d2353e2aab67c7664cd222244c8e97c8e24b95

Comments