MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e52b4395cb4d05df52199765df38f24da669e16a23478fe6a76c6a1c293a1bc6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e52b4395cb4d05df52199765df38f24da669e16a23478fe6a76c6a1c293a1bc6
SHA3-384 hash: 6dc5f110ef1d1bbdc257793aac8cc51c8ed3a126d795ee7fce28864fc2f0c98e73e5ea6665bf0aa98aaf76a2bc7e43a2
SHA1 hash: 25fb7cd03fb812f628e035b3224614136c40cd1d
MD5 hash: 58db3377c45ea44964326fa01d4a3f3d
humanhash: fillet-triple-floor-kitten
File name:Revised proforma.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:378'718 bytes
First seen:2020-06-11 12:22:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:2PHudM3H7yZ1N8eJDWltGkZ/JO4bAA6dSvUugortfcvv:I7yZ1N8eJDcZJaA5vUDutfG
TLSH 7B84231A6EBA8F4C942EB0F64C549E37FC7990D9308F91F1F58865F81087C42DA2361B
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: joister.net
Sending IP: 103.2.236.240
From: mohammed.jabbar. <ams_tach@emirates.net.ae>
Subject: Re: Confirm revised invoice to proceed with payment ASAP.
Attachment: Revised proforma.arj (contains "Revised proforma.exe")

AgentTesla SMTP exfil server:
mail.titanworkinharders.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.42048.26267.24131.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 12:24:07 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4uvuhfoljuc56uqzs5s56ohsjwtgtylkendy7zvhnrvbykj2dpda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e52b4395cb4d05df52199765df38f24da669e16a23478fe6a76c6a1c293a1bc6

(this sample)

AgentTesla

Executable exe c7b7c2ff6402791b77802adec320c905fb0ea9b5ca8ea72735156ce5f19e5660

  
Dropping
MD5 141c5065e3e877fc908074c27c75f1be
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c7b7c2ff6402791b77802adec320c905fb0ea9b5ca8ea72735156ce5f19e5660

Comments