MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 597a70580cef29fa717a55cd00e6c955929b427926b1bade7d5bdb836ccf578e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 597a70580cef29fa717a55cd00e6c955929b427926b1bade7d5bdb836ccf578e
SHA3-384 hash: f9b2af5d24bee678c11c5f457473391df503d83329c10b7dfb0e053bc2f95cc5035b628b60c8abac3bd079ce54863f16
SHA1 hash: fbecc589b19f58aff78b57d4f11dbe9facf13192
MD5 hash: d1d9626e885e109acd415ea2322345de
humanhash: eight-utah-september-alpha
File name:PO011945-xls.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:385'758 bytes
First seen:2020-06-03 07:53:37 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:MhGJ5jTPOJmxWLxYcnFNi8LrTo66o9OOU24CpyMK0GRRiGR3+k2SuM7inHxIeC8n:6O5HmAGxYEDi8/QjdAmXr7iHxIxm7FFH
TLSH D08423BE027A4168B2AC95F7B5F452A55F84148E4835CDEF30C7BE86CE413751DCA0AB
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: park-mx.above.com
Sending IP: 103.224.212.34
From: Cat M. Delizo <sales@centsys.co.za>
Subject: RE: URGENT!!! Quotation Inquiry
Attachment: PO011945-xls.rar (contains "PO011945-xls.exe")

AgentTesla SMTP exfil server:
mail.almushrefcoop.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 04:29:39 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lf5hawam54u7u4l2kxgqbzwjkwjjwqtze2y3vxt5lpnyg3gpk6ha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 597a70580cef29fa717a55cd00e6c955929b427926b1bade7d5bdb836ccf578e

(this sample)

AgentTesla

Executable exe 2f596498224c1a3dbe1dd61709c82f553ec608c406b13ca6379c27540c0a4d05

  
Dropping
MD5 ea8c72dc6c0337d0e8369dfe7ead4348
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2f596498224c1a3dbe1dd61709c82f553ec608c406b13ca6379c27540c0a4d05

Comments