MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93898fc28a1d5221570dd936ff994a9082eb9be55ee4cd1a24c1c9b752284165. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93898fc28a1d5221570dd936ff994a9082eb9be55ee4cd1a24c1c9b752284165
SHA3-384 hash: 155f72eff665a11c0cc0be39bc25b7aee868e532f48ff86c8c3fbd86b8550eb853442ec9af8c1d7b5cfaa8aab7d4be16
SHA1 hash: a07aa267537db194f2b12d5375f8fc21e3cea62d
MD5 hash: 2b3c8aa641cc2108190e953ea0ae7369
humanhash: princess-arkansas-lion-sierra
File name:NEWPURCHASEORDER#176475555675.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-02 07:00:15 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:3FXxxXFWF8gJC6nE7OJRv5pUDwWzr/6BZX9wQhvIHZ2a6OD:5xbA8nOJRRpU5/mw
TLSH 2D45E09DB21072DFC857C172CAA91DB4EB61707B531B8223B42B519EAB4C887CF245F2
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: tazza.cz
Sending IP: 103.141.136.180
From: Coreynava<salek@tazza.cz>
Subject: NEW PURCHASE ORDER
Attachment: NEWPURCHASEORDER#176475555675.IMG (contains "NEWPURCHASEORDER#176475555675.exe")

AgentTesla SMTP exfil server:
mail.sridurgaagros.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 02:24:00 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
13 of 31 (41.94%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=soey7qukdvjccvyn3e3p7gkkscboxg7fl3sm2greyhe3ouriifsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 93898fc28a1d5221570dd936ff994a9082eb9be55ee4cd1a24c1c9b752284165

(this sample)

AgentTesla

Executable exe 726480717cb57cb9285b24bd2e7b43aecc0656cf724b1b21c3d69c759c285945

  
Dropping
MD5 8d5d449c0bd230ae06c2c481b679405f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 726480717cb57cb9285b24bd2e7b43aecc0656cf724b1b21c3d69c759c285945

Comments