MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e486fae3052d8c87e3ea579e6de86c2f0b2b9d6a1b2ee7e6cc7a234122a5b01d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e486fae3052d8c87e3ea579e6de86c2f0b2b9d6a1b2ee7e6cc7a234122a5b01d
SHA3-384 hash: 8e4950ba9fde0121f1e272d93faa15a67938f45914aa587557d04d3c9afd062e1c3abf019b4dcad1f0c75c0c56e8899e
SHA1 hash: 0945808c2f8e8855b58cd0b31adf62eb22631bf8
MD5 hash: 95d458193868204b26fa4f32cc2daa64
humanhash: hamper-apart-twenty-zebra
File name:CNC-2020893378446724562_Lathe V200_VQcFcMBhhIL0qYO__________PDF.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:529'020 bytes
First seen:2020-04-30 11:35:11 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:opADLwGjAjtKbxT7/zkE96PfwLlH8Y7J/nhZTM:PwGjEtKbh9Bl/nhC
TLSH 3DB423A62DF7564C8B56B03C7238766979AB843EBF71E42C324E6F57A33D30602211B4
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dji.com
Sending IP: 103.99.1.148
From: Bryan.Liu<avant.fu@dji.com>
Subject: AW:Invoice Copy
Attachment: CNC-2020893378446724562_Lathe V200_VQcFcMBhhIL0qYO__________PDF.gz (contains "CNC-2020893378446724562_Lathe V200_VQcFcMBhhIL0qYO.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 12:37:19 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4sdpvyyffwgipy7kk6pg32dmf4fsxhlkdmxopzwmpirucivfwaoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e486fae3052d8c87e3ea579e6de86c2f0b2b9d6a1b2ee7e6cc7a234122a5b01d

(this sample)

AgentTesla

Executable exe 875ffba606e3244a1644cd39e50e7eb9ee7d9d93f99bc56019b52fcada9b95a5

  
Dropping
MD5 9183bd39d4149d51b1a9040c749e0136
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 875ffba606e3244a1644cd39e50e7eb9ee7d9d93f99bc56019b52fcada9b95a5

Comments