MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98571f220ae92ea785509d29dfa774a81a820e4be4b3f132665cfaf08fdf6e90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98571f220ae92ea785509d29dfa774a81a820e4be4b3f132665cfaf08fdf6e90
SHA3-384 hash: d4b279c61bde25899bb38887de24cedb57112b57b7df2b0ae5cb7b7e7c7797125a5bfc786b6ba987ae821d35896d4e3e
SHA1 hash: 6a278d4729e9e7e162a9a55ff65a8286cafb42b6
MD5 hash: 1432170396062955583b1aaffffcdeb6
humanhash: neptune-sierra-floor-north
File name:PO .pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:458'209 bytes
First seen:2020-05-06 07:43:13 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:OM0jY3X8GfEQOaLh7CPs0GpnNQZMykZKaMKerv3WMJmcEhQIRhLTH+:OBc3MGcQOgh7r0G9NQZMCHv3WMkdhH+
TLSH 9CA42369C89F059A1DCF4D3D5339BB2489C52AB60F2E4CC48DFBA329C19C7988CBD546
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sunshinespecialities.com
Sending IP: 156.96.45.195
From: Karim Export <Karim@sunshinespecialities.com>
Subject: NEW PO
Attachment: PO .pdf.z (contains "PO .pdf.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 03:45:49 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tblr6iqk5exkpbkqtuu57j3uvaniedsl4sz7cmtglt5pbd67n2ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 98571f220ae92ea785509d29dfa774a81a820e4be4b3f132665cfaf08fdf6e90

(this sample)

AgentTesla

Executable exe de424e79273b01addb5848344ecf859fcc44375bf8ecc26bf1f371ef80c96ec0

  
Dropping
MD5 5f1c5e46d6209bce899da7b7daaf71de
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 de424e79273b01addb5848344ecf859fcc44375bf8ecc26bf1f371ef80c96ec0

Comments