MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 844d5ae62357e86697a5cc5541ad8d1862b62dd9701855e916e1235005336bf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 844d5ae62357e86697a5cc5541ad8d1862b62dd9701855e916e1235005336bf0
SHA3-384 hash: 4de7736742b59d38721b2aceab74b18262d5e7a6d36e4568feb3e5fe63a263f60040c35698bb49c0cac1eab9df08ebfb
SHA1 hash: 7f4c05cdf0ffbb867202caed71c6b36df8494651
MD5 hash: b817248a9b13e3ea3e600692a832a263
humanhash: mobile-spring-white-cold
File name:TMP-376000.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:299'021 bytes
First seen:2020-07-22 07:44:41 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:o+NAXuz3hozJPq8vnJO7Yh8zCVd5mHPjc5/4hbreCzDa:N2uzxozlRvJO7Ye2wPjmwomDa
TLSH EF5423AF131DAF5BF0CAE7C467DD222D152F4BC74C5DD198ABE7A10380A3AC6885B520
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: serve0.lumoss23.pw
Sending IP: 104.168.164.93
From: Mookarin Thaweephot <lr@lumoss23.pw>
Subject: Re: PO NO.TMP-376 & 377
Attachment: TMP-376000.7z (contains "TMP-376000.exe")

AgentTesla SMTP exfil server:
mail.crediseexports.com:587

AgentTesla SMTP exfil email address:
usmilitarydefense@pentagon-dc.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/844d5ae62357e86697a5cc5541ad8d1862b62dd9701855e916e1235005336bf0/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 07:46:08 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qrgvvzrdk7ugnf5fzrkudlmndbrlmlozoamfl2iw4ervabjtnpya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/844d5ae62357e86697a5cc5541ad8d1862b62dd9701855e916e1235005336bf0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 844d5ae62357e86697a5cc5541ad8d1862b62dd9701855e916e1235005336bf0

(this sample)

AgentTesla

Executable exe 32ec92b57297749ae4e4cc6299579355e77573ffdf0b125d1f65ebcc62b9fbfb

  
Dropping
MD5 4f95864e11669a1aa74b6efe3b47b50b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 32ec92b57297749ae4e4cc6299579355e77573ffdf0b125d1f65ebcc62b9fbfb

Comments