MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e345824554d73586488770001ea9fec6c6bb521bb97a2b5e9a35ae26b7e12af9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e345824554d73586488770001ea9fec6c6bb521bb97a2b5e9a35ae26b7e12af9
SHA3-384 hash: dfd66a83e372c5b2f88949ef35b55074b9c039a9c8ada3d8200a1e2805fcbf5bcfb911b72f2a1e7751df0940ab03d222
SHA1 hash: b5d6ccd84dd18c4a1a79a4a22f44afb1f01d1221
MD5 hash: 4cc5dde707879238cc20da9062202655
humanhash: fruit-december-mango-ohio
File name:PO 000349 THERMAL MATIC SYSTEMS SDN BHD.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:417'018 bytes
First seen:2020-08-05 09:31:23 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:YLKJpWtOd6JeugmvZwcYlQLdydm4amTPW4:Xz6Jedm+PnamTu4
TLSH DC9423DF8EB632665527FB67099C0BCCD28C6F859715E60E1015C57A4F28BEBC026C0E
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: shivam@elyzium.co.in
Subject: PO 10437923
Attachment: PO 000349 THERMAL MATIC SYSTEMS SDN BHD.gz (contains "PO 000349 THERMAL MATIC SYSTEMS SDN BHD.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:25

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e345824554d73586488770001ea9fec6c6bb521bb97a2b5e9a35ae26b7e12af9/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:33:05 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4ncyerku242ymsehoaab5kp6y3dlwuq3xf5cwxu2gwxcnn7bfl4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e345824554d73586488770001ea9fec6c6bb521bb97a2b5e9a35ae26b7e12af9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz e345824554d73586488770001ea9fec6c6bb521bb97a2b5e9a35ae26b7e12af9

(this sample)

AgentTesla

Executable exe 5f076bc30f80bc1b5fd90a7624625c5e42c4d5869b51926b54fcc4456ed32cd9

  
Dropping
MD5 3d0b9d61dcedf171ac9952006dfb595d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5f076bc30f80bc1b5fd90a7624625c5e42c4d5869b51926b54fcc4456ed32cd9

Comments