MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c757e43d68834593f53aeeb395af1a9e3588700bd457af8b8cc2c6610fdd274a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c757e43d68834593f53aeeb395af1a9e3588700bd457af8b8cc2c6610fdd274a
SHA3-384 hash: 49559ef4911b9541791ff40821096e7809e80f6cb665900c36683fef84cd237e947460b5689d30e23021ee585c73966f
SHA1 hash: a33ca3a5ddcb7d2b6a0e130432ab0a279a43d697
MD5 hash: c6095b873b80f83a31790c500a4fb63c
humanhash: lactose-connecticut-idaho-green
File name:payment slip.2020.05.14.999.087.642.1242.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:389'701 bytes
First seen:2020-05-14 06:43:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:iLk8hjg5KXGqp1earHzAJJoX4w0AIwKJtyavD+CJ1MHWS0I5V7Pja0aIv8Zfef98:iBhkd+earHzAJqQfwCL9SrVHatI/9ggw
TLSH 928423D568617B62DC89943C638167C13615E2C7CCA5FA3A382AFDC9EE1B10E2F135D8
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp1.kaist.ac.kr
Sending IP: 143.248.5.228
From: 이희성<hs4101@kaist.ac.kr>
Subject: Please confirm payment
Attachment: payment slip.2020.05.14.999.087.642.1242.zip (contains "YG4eCD7BQ850fEp.exe")

AgentTesla SMTP exfil server:
smtp.linxons.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 07:36:59 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y5l6ipliqnczh5j252zzlly2ty2yq4al2rl27c4myldgcd65e5fa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c757e43d68834593f53aeeb395af1a9e3588700bd457af8b8cc2c6610fdd274a

(this sample)

AgentTesla

Executable exe 5556fd4e05f530387ffc197111e21e50fb37387e824f738332e95ae834cc673c

  
Dropping
MD5 e6943748ba61c1608fea1ad269540883
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5556fd4e05f530387ffc197111e21e50fb37387e824f738332e95ae834cc673c

Comments