MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a354e72736a48872f69c01ee7b42f7a95efef3d396feb2b21612d0e411a59fe6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara Comments

SHA256 hash: a354e72736a48872f69c01ee7b42f7a95efef3d396feb2b21612d0e411a59fe6
SHA3-384 hash: cba4f0b0f1a4011c6ba1ea11147705018206aba7b8aaaf5c1333e263382cff9c127e9fd01f6ca2180e18d31103202d6b
SHA1 hash: 8db5f988f3037b2755c32ee941999387f55c799f
MD5 hash: 7ec02d3cdb1d634123e39fc0bc4f0c49
humanhash: hotel-twelve-uranus-yellow
File name:P.O 6095-SAP.Gz
Download: download sample
Signature AgentTesla
File size:400'862 bytes
First seen:2020-06-30 08:46:54 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:fQwqSOeQeBG1OiLLHAOct43pbQY7x6sRlYSAcGRUVW8FZ7HR74PSoM:ofSOteBG1XLx44p3dRWnc0/8FZ7V4PSb
TLSH 5F842376B46C2BA88FB2FA03A7124A17D45787FCD455502299AECDE0FD399C1B8C1C26
Reporter @abuse_ch
Tags:AgentTesla gz


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: vega.awedns.com
Sending IP: 101.99.77.53
From: Elayaharasi <sales@global-mfg.com>
Reply-To: liangchiphlippines@gmail.com
Subject: Purchase Order No. 6095-SAP (Ref. No. 587-MCS-19).
Attachment: P.O 6095-SAP.Gz (contains "P.O 6095-SAP.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 23
Origin country FR FR
ClamAV No detection
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/a354e72736a48872f69c01ee7b42f7a95efef3d396feb2b21612d0e411a59fe6/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 08:48:09 UTC
AV detection:13 of 31 (41.94%)
Threat level:   2/5
Spamhaus Hash Blocklist :Suspicious file
VirusTotal:Virustotal results 4.84%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz a354e72736a48872f69c01ee7b42f7a95efef3d396feb2b21612d0e411a59fe6

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments