MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da17d2863780d7422481dd52aef3f7198565414a5a459f678ad2e570df9b5cde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da17d2863780d7422481dd52aef3f7198565414a5a459f678ad2e570df9b5cde
SHA3-384 hash: 18e54034bd06e211ad2ef0a69029edd0d163eddafbf0248cdbf4c6703e6b8129a312230554d416745cb5db59c24c20b2
SHA1 hash: 4694a8b1643134c59cfef9c829121869c12fe86d
MD5 hash: 9c6e034e281fa3033317de00db741483
humanhash: robin-network-aspen-asparagus
File name:quotation 210520.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:503'437 bytes
First seen:2020-05-21 10:11:41 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:3ZLvU7ugZaY5hht6ozPb4ft7JhIgTtgYr6PVdQ2oKOuhG8DtIn2:JzU7P0Gt6v7JTxDgQVKHDp
TLSH 7BB423276F2CCFF4AB3832450DD12545AA35211F96FA6C03D2386DA2DDA794F6340ABD
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: saranaprimelestari.com
Sending IP: 209.58.149.66
From: Trikora Ibnu <sale@saranaprimelestari.com>
Subject: Request For Quotation
Attachment: quotation 210520.gz (contains "quotation 210520.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 07:06:19 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3il5fbrxqdluejeb3vjk547xdgcwkqkkljcz6z4k2lsxbx43ltpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz da17d2863780d7422481dd52aef3f7198565414a5a459f678ad2e570df9b5cde

(this sample)

AgentTesla

Executable exe a7e7e0f4c2b259bed0f1fe97d9ced829f59a136e3432d19d93398c4bcc6ddc0c

  
Dropping
MD5 35c8a007cc052be093efbd3ce5b7e505
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a7e7e0f4c2b259bed0f1fe97d9ced829f59a136e3432d19d93398c4bcc6ddc0c

Comments