MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4cbfccf59aef5d47a77cce8b35626e813c5ee96cfa3b7eb54c9c84fb012f903. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e4cbfccf59aef5d47a77cce8b35626e813c5ee96cfa3b7eb54c9c84fb012f903
SHA3-384 hash: 515af4965e490145f95cc2f65b7c0eed78af42c6b42a479901ffe1287f5adbc2a86f8bbb056eedef46db404292e5ae53
SHA1 hash: d828b0578a6db7be69c47cdff88aa49480ebe275
MD5 hash: b0761214fa283abb1c4fc6c731f4f7c8
humanhash: skylark-alanine-north-fanta
File name:RFQ capia de____PDF__5721.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:418'035 bytes
First seen:2020-05-12 08:32:37 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:d4Y/bPkiPf0eoyymSTrDxzxo97CtMwBLUiENBbXe4o0iUZaqjHuEyWLCTPokS9nY:+y7kGHp5STr99oc/iVo9iuAuLFS9nY
TLSH 2494232EFA7738C82F655C0D02479097F9E2F23D3445E76EA61126C586EBA098F7441B
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail4.luconsult.ro
Sending IP: 195.62.95.50
From: Anna Zeng <eric@orientgene.com>
Subject: preços e disponibilidade para o seu pedido 5721
Attachment: RFQ capia de____PDF__5721.gz (contains "RFQ capia de____PDF__5721.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 08:36:09 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4tf7zt2zv325i6txztulgvrg5aj4l3uwz6r3p22uzhee7mas7ebq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz e4cbfccf59aef5d47a77cce8b35626e813c5ee96cfa3b7eb54c9c84fb012f903

(this sample)

AgentTesla

Executable exe f1d7247c8ffbddee868cba452966a10f19c0191f945759589134f1e2f67599c9

  
Dropping
MD5 2cc13eb9843601601a70d384478b2fee
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f1d7247c8ffbddee868cba452966a10f19c0191f945759589134f1e2f67599c9

Comments