MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 642f7117911844788c7a17cfd5c15e21ec92ecfd6ee481956c3d7d32f286c679. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 642f7117911844788c7a17cfd5c15e21ec92ecfd6ee481956c3d7d32f286c679
SHA3-384 hash: 84d12c24cf1bbbaec8681faffcbb39717b409a7dc7c1b8843b321fdd48d015e9c184f4ff51505b09449595b2ae27e502
SHA1 hash: 84e22fce2a466598901cd7dec82038d3b9fe41fd
MD5 hash: 3fb6b09861da9bf78623bce8d4ad2328
humanhash: neptune-finch-washington-stream
File name:Product Inquiry.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:437'441 bytes
First seen:2020-06-10 07:16:14 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:njLJaJWqrL4HcUy5MsESYov96ODzqCfRsaC0Om:jNiLSc/20J16OHqCfaF6
TLSH 90942305C623469A38F24D2DC0BEAEF796DEDDA14CE75CA4F217A1263053727E8D80D6
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.228
From: exports@lema-part.com
Subject: Product Inquiry.
Attachment: Product Inquiry.arj (contains "Product Inquiry.exe")

AgentTesla SMTP exfil server:
mail.karcek.com.tr:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 07:18:04 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mqxxcf4rdbchrdd2c7h5lqk6ehwjf3h5n3sidflmhv6tf4ugyz4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 642f7117911844788c7a17cfd5c15e21ec92ecfd6ee481956c3d7d32f286c679

(this sample)

AgentTesla

Executable exe 4a5ba37101ef029435b69fe77e8af8924e4714c66a32390f83a5546025f42200

  
Dropping
MD5 afe8ac2494492762e8ab91a08a00fb55
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4a5ba37101ef029435b69fe77e8af8924e4714c66a32390f83a5546025f42200

Comments