MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a50ad717b3fd8447c49a1b093a036885957627d37f5fb93c04a50468fb51e4ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a50ad717b3fd8447c49a1b093a036885957627d37f5fb93c04a50468fb51e4ba
SHA3-384 hash: 2bbb0644fd6ef0d5fbc6ca950390cbd77351885e2ada7601431df6302d3f9d9f83a9a92aa1eff74aeedd82c7f99cc611
SHA1 hash: 9b420a8ba3fb946246baf11235618203ee8ccb60
MD5 hash: 9e20f227eb82f129b1ea3d6c68d01ad3
humanhash: twelve-neptune-potato-echo
File name:Scan Document.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:240'696 bytes
First seen:2020-05-14 19:33:55 UTC
Last seen:2020-05-14 21:03:52 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:Wwp+DgY5TIuXIXjAt9h5jOS/WHQREoR3Idm7Jq:iz0uAK9h5awWwrRS0q
TLSH 4134231396F60D668E31985A967D170C4D3007C1A873ACF0D9A8BBC15BEBDF9C50A6EC
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
2
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-15 04:20:06 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uufnof5t7wcepre2dmetua3iqwkxmj6tp5p3spaeuucgr62r4s5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar a50ad717b3fd8447c49a1b093a036885957627d37f5fb93c04a50468fb51e4ba

(this sample)

AgentTesla

Executable exe 0f7facae07fd7efc8eb9a2b6916eb8d912fe48d3a74a9629d110856df8144a65

  
Dropped by
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0f7facae07fd7efc8eb9a2b6916eb8d912fe48d3a74a9629d110856df8144a65
  
Dropping
MD5 d5de9f6dcd933604c724c7dfff5ac4ac

Comments


Avatar
Corsin Camichel commented on 2020-05-14 21:04:41 UTC

Malicious email
From: "Vicky Li" <mktg@crimsonintl.com>
Received: from crimsonintl.com (unknown [37.49.230.215])
Date: 14 May 2020 22:40:44 +0200
Subject: RE: ORDER APPROVED
Attachment: Scan Document.rar