MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58aedcada968623a6f82b3fa0d5305d11c44c6bd1dc163e79a7e9592f2ad60fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58aedcada968623a6f82b3fa0d5305d11c44c6bd1dc163e79a7e9592f2ad60fa
SHA3-384 hash: e60c33d144e1c2ca7b519cab152af421e0c9dfa6bd0a96991cdc30bcc939013ae6ca74e8df34a13dbc5580943adc9744
SHA1 hash: 9f7bf4140b95ff62cf83d7d075d72cdea675ef16
MD5 hash: ddcd6df61a7fb00346af8c9e2574e549
humanhash: california-cup-lithium-chicken
File name:Scan 00190520.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:402'741 bytes
First seen:2020-05-19 06:27:49 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:hE66J6Zo/4pv1D88e8GFmtogluQs2tFj+P:hExJ6Zxpv1QuGQXp5HjU
TLSH 6D8423765B89224EB5E39BCE1791079D2836B7883D76D2743A5FC59B8D20820C904FFD
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: trieaglelogistics.com
Sending IP: 209.58.149.66
From: Carl Sang <import@trieaglelogistics.com>
Subject: Payment Copy
Attachment: Scan 00190520.gz (contains "Scan 00190520.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 05:56:12 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lcxnzlnjnbrdu34cwp5a2uyf2eoejrv5dxawhz42p2kzf4vnmd5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 58aedcada968623a6f82b3fa0d5305d11c44c6bd1dc163e79a7e9592f2ad60fa

(this sample)

AgentTesla

Executable exe 96b4c0eb2ed053c03c8f12c8a46c218490a064ff43b4b29eb6883e758d13f624

  
Dropping
MD5 66c301096cb233f45931fc4d7e68b93c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 96b4c0eb2ed053c03c8f12c8a46c218490a064ff43b4b29eb6883e758d13f624

Comments