MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bab21d1486af54dbb750085fa4fdd9b6ff173e587ca066ce773db2271ed2366c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bab21d1486af54dbb750085fa4fdd9b6ff173e587ca066ce773db2271ed2366c
SHA3-384 hash: 77cf2c10348627c8c8e9a0a6da66e7ae582130577c30a21d8b98fa5dfdc9b47c5026165bdcd1b9c85825ea456bac4205
SHA1 hash: 2843bfcc4124f53fd31fa2bdbad0a31d152f6b82
MD5 hash: 9ae5e53fa188d4d40c48a7d9dd8f92c4
humanhash: oregon-massachusetts-wyoming-floor
File name:NEW ORDER ITEM.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:406'956 bytes
First seen:2020-05-11 14:06:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:AD3rvK35QyTA4kr9EDy/+3vrfeqH51mNVS:AfGTA42yDyG3zWW57
TLSH 448423B091E3FC6A6D1B1592E14FEAE0FD5741414E9F6328325826BC0E597CFA11B0EB
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.ence.marketing
Sending IP: 62.138.11.76
From: Alikambar Navab Hasan <alikambar@algurgoman.com>
Reply-To: serhaitoguz34@gmail.com
Subject: RE: REQUEST FOR QUOTATION GURG CO. L.L.C
Attachment: NEW ORDER ITEM.zip (contains "NEW ORDER ITEM.exe")

AgentTesla SMTP exfil server:
mail.orientalkuwait.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Suspicious
First seen:
2020-05-11 08:10:26 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xkzb2fegv5knxn2qbbp2j7ozw37ropsypsqgnttxhwzcohwsgzwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip bab21d1486af54dbb750085fa4fdd9b6ff173e587ca066ce773db2271ed2366c

(this sample)

AgentTesla

Executable exe 9fed5314906b5873cd970313215aeb2714819bb965dc4bb7648154f1dddb6680

  
Dropping
MD5 966e9356e8434266b7e4b3fc78045201
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9fed5314906b5873cd970313215aeb2714819bb965dc4bb7648154f1dddb6680

Comments