MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9334df0889964ea77dcd40b05a830360bc9574b6a52623112ba43bc41b2a6528. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9334df0889964ea77dcd40b05a830360bc9574b6a52623112ba43bc41b2a6528
SHA3-384 hash: 8f0f1d5cd2d16c7483bdbff456591407f9d97b678509cc1a0091f3d97122c66ea0af0739c7b785001857d7eaa8c86e16
SHA1 hash: 2435b467ca0e086e98ea6fd6a2897bbf853b800c
MD5 hash: 7fa551887125cc070d0334153507f161
humanhash: massachusetts-wyoming-harry-aspen
File name:Quote202005DOC56.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:408'691 bytes
First seen:2020-05-27 08:50:15 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:2TO8blqyy2p335g/jKgbao8KNH9iYL7W7MqbSGVQD+M:2TO8ho2p5hgbMKNH9iyW7MqbSw1M
TLSH 339423746389F07C5975CEAAF13D38AEE124C0E6812100966796F5B354F0F8E3E08BB9
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mstdlrgw.mst-dealer.com
Sending IP: 203.146.21.245
From: Salil Johory <dlr-a238@mst-dealer.com>
Subject: Request for Sales Quotation (URGENT)
Attachment: Quote202005DOC56.pdf.z (contains "Quote#202005#DOC56.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 09:07:50 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
12 of 30 (40.00%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 9334df0889964ea77dcd40b05a830360bc9574b6a52623112ba43bc41b2a6528

(this sample)

AgentTesla

Executable exe 3a583a9fa9039210e8d683200ca25b32993cd1840808ba3bac62f2c6e29ca7d9

  
Dropping
MD5 b9a73286876b2dee4506207dfa73f255
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a583a9fa9039210e8d683200ca25b32993cd1840808ba3bac62f2c6e29ca7d9

Comments