MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d5eadec342fe5e1e269f032a05ef1651ab5f654b8654d4b84c369fec3c7b9d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d5eadec342fe5e1e269f032a05ef1651ab5f654b8654d4b84c369fec3c7b9d8
SHA3-384 hash: e5dd11098287ca5a828e7178de7042e736259290e997329c48b2127cca9cc96be5e3c28a2d1104ee3d5e00eaa638ac8f
SHA1 hash: e4fe05ac34ebf84cd59dec2bbc7fd241803c8d65
MD5 hash: 16263e0945076bc1bbbd1fc344f9f876
humanhash: july-cat-summer-quebec
File name:Dragon Sourcing Co, Ltd - products inquiry list.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:433'025 bytes
First seen:2020-05-12 08:05:19 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:L29DrMw4G8HlwWyT3MGPAjmAN63O8ExMT:mrMw2wLzImAirT
TLSH C194230C9F37D071B06D58A62483B0D526AA2821C16EF7CB871F987B2257527F86EBC5
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cpb2.medionline.cl
Sending IP: 45.55.49.33
From: Vu Duong <nihao@dragonsourcing.com>
Subject: Dragon Sourcing Co, Ltd - Products Inquiry from our clients
Attachment: Dragon Sourcing Co, Ltd - products inquiry list.z (contains "Dragon Sourcing Co, Ltd - products inquiry list.exe")

AgentTesla SMTP exfil server:
premium101.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 18:04:32 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nvpk33buf7s6dytj6azkaxxrmunll5suxbsu2s4eynu75q6hxhma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 6d5eadec342fe5e1e269f032a05ef1651ab5f654b8654d4b84c369fec3c7b9d8

(this sample)

AgentTesla

Executable exe d364a64f878c7a01c622cfb107ebe9776a9defadfce6875fc37b703e695dfa50

  
Dropping
MD5 9d52f6036bc07e438d7438aa71190e96
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d364a64f878c7a01c622cfb107ebe9776a9defadfce6875fc37b703e695dfa50

Comments