MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b51ccb33f7c2ac34a09ac9a3df37d32d3cf7980242eca7897d91188b0a4715e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b51ccb33f7c2ac34a09ac9a3df37d32d3cf7980242eca7897d91188b0a4715e
SHA3-384 hash: 7a35e107523a239f860e01981e76bee5f891e76b69f4d368379c5466c0795de30d7cd4829f5aa4f26c666d7cd0efa1e3
SHA1 hash: 397ee60f0e65fb1115fbc346ba6ab808f73b3f10
MD5 hash: 237d7eda2a4dfe72264ea5a238ab6cb6
humanhash: three-white-high-vermont
File name:payment confirmation copy632020.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:503'530 bytes
First seen:2020-06-03 12:51:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:jC81ezeJnj3eqOEjugjemPcBrECDrXpZC919:jC81pbROs1RXQrX7C39
TLSH DDB423614C76F4A495B7C2A8F4CAA437F8E6A643F8CC83AE1110C987D7BD1077E44E65
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: odysseylogistics.com
Sending IP: 37.49.230.30
From: Dispatch00@odysseylogistics.com
Subject: payment confirmation copy632020
Attachment: payment confirmation copy632020.zip (contains "DOWNLOAD RFQ.exe")

AgentTesla SMTP exfil server:
smtp.bnb-spa.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 04:29:30 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lni4zmz7pqvmgsqjvsnd3435glj466maeqxmu6ex3eiyrmfeofpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5b51ccb33f7c2ac34a09ac9a3df37d32d3cf7980242eca7897d91188b0a4715e

(this sample)

AgentTesla

Executable exe 66f1141f641be090463b0f797b11f348ba8c34f1fdd2f48f91b76604d9a6c707

  
Dropping
MD5 2e885aac8920e4340565db77870472c1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 66f1141f641be090463b0f797b11f348ba8c34f1fdd2f48f91b76604d9a6c707

Comments