MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56455b7e36f29bfbb0a7fd4967458dac310336b38d32c9ace4be0903908e5cfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56455b7e36f29bfbb0a7fd4967458dac310336b38d32c9ace4be0903908e5cfe
SHA3-384 hash: df8261e7095650a1271028ab1feb9b6c451b25002973347cc38de1c553fe5a72feb595864bfc24fd58114593eeddb170
SHA1 hash: 5b85ee405add8ccddebc42a3d888baf481513f23
MD5 hash: 1581eae5d25c6677cd8e69468a9ef3ca
humanhash: montana-nuts-july-vermont
File name:new_order_6552_8288_file.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:384'332 bytes
First seen:2020-06-23 05:43:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:uG+HAe5c3m6sXo1NWIRArY6mpXHuNVjt3MrHhZvBeinRM6+YFu1Rl8MQ7m8II9Zv:uG+gyymE1NvRA8BuNVjgBZbRJ+YFu1HE
TLSH A9842318C0D14B57D5F9496322F8DB44CCB9B98AFA3831DBBA0274F17CAFB100B5959A
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.befactto.tk
Sending IP: 173.82.168.26
From: David Cooper <admin@befactto.tk>
Subject: request for quotation
Attachment: new_order_6552_8288_file.zip (contains "new_order_#6552_8288_file.exe")

AgentTesla SMTP exfil server:
smtp.bazaarkonections.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis63715DF92E44.17574.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/56455b7e36f29bfbb0a7fd4967458dac310336b38d32c9ace4be0903908e5cfe/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-23 05:45:05 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kzcvw7rw6kn7xmfh7vewormnvqyqgnvtruzmtlhexyeqheeolt7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 56455b7e36f29bfbb0a7fd4967458dac310336b38d32c9ace4be0903908e5cfe

(this sample)

AgentTesla

Executable exe 69ae33d3de4e9ab0200a9c58cde93a8413d35b92116ce40595af0840eaa56952

  
Dropping
MD5 c640e0e3774f0acce1bcc286e125f756
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 69ae33d3de4e9ab0200a9c58cde93a8413d35b92116ce40595af0840eaa56952

Comments