MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbd5df17f386ddf436a63b69a37ba8e6a61555894e429efc817af6fa3dbeb97a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dbd5df17f386ddf436a63b69a37ba8e6a61555894e429efc817af6fa3dbeb97a
SHA3-384 hash: d80cc7cd6381a8593283134a397ce3eb271352242d192b51a66d2f326923526f4fc22773ddb51dc822aae53db29c3dbb
SHA1 hash: 347ae5bd1438690243238ec16c65eaef73e71e32
MD5 hash: 295024a6cca736ca6946e34050a0a602
humanhash: nevada-glucose-alabama-quiet
File name:Booking Ref1 DF000083-JJ.cab
Download: download sample
Signature AgentTesla
Create hunting rule
File size:830'455 bytes
First seen:2020-06-03 14:47:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:qZ/X+WBe8dk45vYE4J25erz0UJ9fVgypqNyQ:q9X+we8dkXJGevnJ9fmysyQ
TLSH 3C0533664BC26F8D0D8861FBA8031630BA61484F910566E77AF7F4D36DCACE08CBD162
Reporter abuse_ch
Tags:AgentTesla cab


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: apollo.t.mk
Sending IP: 195.26.152.35
From: drmtanevski@t.mk <drmtanevski@t.mk>
Subject: BOOKING
Attachment: Booking Ref1 DF000083-JJ.cab (contains "Booking (Ref1 DF000083-JJ).exe")

AgentTesla SMTP exfil server:
mail.radiomeff.mk:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 15:36:10 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3pk56f7tq3o7invghnu2g65i42tbkvmjjzbj57ebpl3pupn6xf5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar dbd5df17f386ddf436a63b69a37ba8e6a61555894e429efc817af6fa3dbeb97a

(this sample)

AgentTesla

Executable exe 924d2110a668acae185a205cc51772d088304b941e306ae369b7f62f788d3632

  
Dropping
MD5 fe0cf73b7c8a067c1217d0cb5f7c5f39
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 924d2110a668acae185a205cc51772d088304b941e306ae369b7f62f788d3632

Comments