MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd924d0259707b0fc2416ad596668bfeb35982cf9cfa67ce101b0059a92bbad2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd924d0259707b0fc2416ad596668bfeb35982cf9cfa67ce101b0059a92bbad2
SHA3-384 hash: 847605fbeb19b8ee957aa70bd4b71ed48a98ce4946834aa261aa9822559c7e3f55711b07f7a9c4c453db165ffb82bc07
SHA1 hash: 209e4b9be2a5d97d61e730d5049f10607748342f
MD5 hash: 3af7201ef0f9fc659149de471da09fb1
humanhash: high-river-item-red
File name:PO-881763783-sn-877588983y3.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:375'254 bytes
First seen:2020-06-03 11:31:27 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 6144:l6WSjoB/duMffLzZabxwoZXsQWeW5itwFmybi62Wlk0zK8wSR60lFqrDGpc8720:looBFumv8ZXDqKqmybi61lHxR6N2B720
TLSH 948423E262A843F7093E787409F066F750D6446E74A7CE6B02EE3B81D1B98547AF3271
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: panel201.redservidores.com
Sending IP: 185.79.131.34
From: Lee Seo <L.seo@krones.com>
Reply-To: Lee Seo <nurdan.ozirneks@gmail.com>
Subject: Quotation From our customers
Attachment: PO-881763783-sn-877588983y3.7z (contains "PO-881763783-sn-877588983y3.exe")

AgentTesla FTP exfil server:
ftp.autobulbs.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 11:38:02 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3wje2aszob5q7qsbnlkzmzul72zvtawptt5gptqqdmaftkjlxlja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z dd924d0259707b0fc2416ad596668bfeb35982cf9cfa67ce101b0059a92bbad2

(this sample)

AgentTesla

Executable exe 5662a5a5856dda46d1d49744df2f441debcbc68da33957b01034616632cd398d

  
Dropping
MD5 da89ab4633fec3851a3b6b91a00d416b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5662a5a5856dda46d1d49744df2f441debcbc68da33957b01034616632cd398d

Comments