MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a30b9eb59c13390a5879046b45975b2c60064d24cc8ac0ba42f3f7310b9b064d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a30b9eb59c13390a5879046b45975b2c60064d24cc8ac0ba42f3f7310b9b064d
SHA3-384 hash: 802d1df55fb86d76d6d05c81ee311d9a432e1175340edfb71cb2c186622c42869a0ee31797e567a7231f27af4aa8c647
SHA1 hash: d027910c6dac4c32ee2c2db1e57649abeb8a2810
MD5 hash: 30268999bfb7fbe2c5f2b0b4dd0a6515
humanhash: enemy-venus-diet-paris
File name:QT20050809.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:449'753 bytes
First seen:2020-06-10 06:59:05 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:Ut2Td1HwShWxM7IIbstC087TV2/IcHfzfF1p:Ued1eyBX70/vzF
TLSH DAA4232F87431DEDDC25F21671522ACCA98538D60456D13F431937B0AAB3B6EB42F4A7
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server0.grupojutse.com
Sending IP: 142.11.213.100
From: Purchase <office@grupojutse.com>
Subject: INQUIRY QT20050809 
Attachment: QT20050809.z (contains "QT20050809.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 07:01:03 UTC
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=umfz5nm4cm4quwdzarvulf23frqamtjezsfmbosc6p3tcc43azgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z a30b9eb59c13390a5879046b45975b2c60064d24cc8ac0ba42f3f7310b9b064d

(this sample)

AgentTesla

Executable exe d7626cd481f42298575d733d11397dadd983211978d510c248b872a5e8000c1a

  
Dropping
MD5 41303a6a7315f54898f527101353f800
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d7626cd481f42298575d733d11397dadd983211978d510c248b872a5e8000c1a

Comments