MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c513de518c15eeb828a603da81904f8e47dc1b4c8789bcd8338787557b97b19f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c513de518c15eeb828a603da81904f8e47dc1b4c8789bcd8338787557b97b19f
SHA3-384 hash: 6031bf6fb7cd0ff4c4e1d5d7f5d3b8d4d072a412e949fb190cec1e7d0f96429622840a8a72bb78020fbfd66025d0bea4
SHA1 hash: 9d1993c849eea4b3b054ae24ccdd2cfe45364da1
MD5 hash: 01186a7e3eb6bb62d0d8a2ad3b29e8c8
humanhash: music-may-oranges-one
File name:ADVANCE FREIGHT USD INV1191189.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:507'452 bytes
First seen:2020-08-12 15:28:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:uRs8teyQ1RZgcLXJM3ynx88E+fCEWR2ckMclogdS9qc/z5oM9xmN:u3tenvsdgWR2ckvogdSqWTxq
TLSH 4FB423491623736EFA9EC7F92773AD105073713B46B848E500A6ABA2DB77CD90513E0B
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: lmdmw.com
Sending IP: 103.207.38.151
From: lmd@lmdmw.com
Subject: ADVANCE FREIGHT USD INV#1191189
Attachment: ADVANCE FREIGHT USD INV1191189.zip (contains "jkebFcGKNmZ8ZA7.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c513de518c15eeb828a603da81904f8e47dc1b4c8789bcd8338787557b97b19f/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 12:56:53 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yuj54ummcxxlqkfgapnidecprzd5yg2mq6e3zwbtq6dvk64xwgpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c513de518c15eeb828a603da81904f8e47dc1b4c8789bcd8338787557b97b19f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c513de518c15eeb828a603da81904f8e47dc1b4c8789bcd8338787557b97b19f

(this sample)

AgentTesla

Executable exe 653f9230a0dfc61996a0213363c938cc629fe374f877febd3df485369d1f476a

  
Dropping
MD5 40557f36e77d9de2b8441592ecd6f9e4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 653f9230a0dfc61996a0213363c938cc629fe374f877febd3df485369d1f476a

Comments