MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78e99566e6f5579cd2622536e3099c160ebca37fd9eaa3ccd8616677d1f00fdd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78e99566e6f5579cd2622536e3099c160ebca37fd9eaa3ccd8616677d1f00fdd
SHA3-384 hash: f1009c2a34a0bd0e6df615653859a5f59fe6de2d1baea7d53442f2a9278d6f7625c6855f9b0610a1a9106751f8fe4b0b
SHA1 hash: 62f26ef33e9b7894f72107ea5cd3545804c1fd95
MD5 hash: edefa6970d2d9f90a99d764613008e30
humanhash: robert-seventeen-delta-hawaii
File name:New_PO.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'121 bytes
First seen:2020-05-25 18:07:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:xqo4SoCEz+Upl5458B4gDRVLtmBiWnaSYKWI:xqo4zNlXq58BdDRVhMnWI
TLSH 5E94235CE18E99C64C2B6C2782E817173A9487E7C56CCD8F76858400DFE4DAE6AC9F1C
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: zcsmta01.asyst.co.id
Sending IP: 103.9.36.42
From: Thomas Smith <m.saleem@hydrapro.co>
Subject: We are interested in your product
Attachment: New_PO.zip (contains "New_PO.exe")

AgentTesla SMTP exfil server:
mail.menawealthventures.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 18:35:36 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 78e99566e6f5579cd2622536e3099c160ebca37fd9eaa3ccd8616677d1f00fdd

(this sample)

AgentTesla

Executable exe f57973fe9b7144fd299f70cc04bcde1e442f6816de323361f1b09cb63c4e41b4

  
Dropping
MD5 81ebc1fcb55cd9e6a951cc098af5df87
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f57973fe9b7144fd299f70cc04bcde1e442f6816de323361f1b09cb63c4e41b4

Comments