MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 582c09cb88106231b13574cb3bc848cea346558a985bd13d1ccd8031a5a2a0db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 582c09cb88106231b13574cb3bc848cea346558a985bd13d1ccd8031a5a2a0db
SHA3-384 hash: 2f41ddbcfa5d1ad4afd16b317a2025949e89cf530b0c2a0c3e99d94bf433adbd9724ad9c622fb61bd0d14742729ea23a
SHA1 hash: 820ee19536603b894238c1378fde68be63e729b7
MD5 hash: ff721b1231221a271ad4de7355286fa1
humanhash: louisiana-foxtrot-beryllium-burger
File name:Terms & Conditions.pdf (3).zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:432'773 bytes
First seen:2020-05-12 16:08:21 UTC
Last seen:2020-05-12 20:37:50 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:FfyrHXEgoweTbtjnH9XTMX5F3nV08rGSQ:ZyzEdxbtn1T4RfrGSQ
TLSH C59423550C23A7B83A993ABF24C1B1026F275D74104AD79EAA74DA63EDCD548F213CCE
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: maspimienta.com
Sending IP: 103.99.1.174
From: fabian<fabian@maspimienta.com>
Subject: subj;RE: PAYMENT TO BANK DETAILS (CONFIRM BANK DETAILS)
Attachment: Terms & Conditions.pdf (3).zip (contains "qt8hpBzVEeH1O8B.exe")

Intelligence

File Origin
# of uploads :
4
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.67103.24628.12896.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 09:57:32 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lawats4icbrddmjvotftxsciz2rumvmktbn5cpi4zwaddjncudnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 582c09cb88106231b13574cb3bc848cea346558a985bd13d1ccd8031a5a2a0db

(this sample)

AgentTesla

Executable exe dff01b9f8946ed3792fe4e32ae3f95834c892f16ca219dc99d78fd15064f82a2

  
Dropping
MD5 f8c833483ed462c778e1ca98cc9b4e48
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dff01b9f8946ed3792fe4e32ae3f95834c892f16ca219dc99d78fd15064f82a2

Comments