MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f356d124f31490831cc87a00b7435050f14cdf93cf6543bc14977e767320bd04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f356d124f31490831cc87a00b7435050f14cdf93cf6543bc14977e767320bd04
SHA3-384 hash: a032de4e970bdefc16eaaea4fb43acd4a2113da545d1d2219d5064c56ed2cbfb3af988f725df24ce91b02aa4129f0d8f
SHA1 hash: c0f9ee48b1b0ae9566e30e1a171045a5bbf75902
MD5 hash: 3cfbd09807cc6ac777e0fa2a75750528
humanhash: one-harry-one-idaho
File name:Pre-Alert.docx.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:525'052 bytes
First seen:2020-04-30 12:31:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:0S0RiioM8N/IBCogl2Asj20GNFfGyGRkcZiH3:0S0ElM85IBDg0Asj2B3fLhH3
TLSH 38B4234AA5473F48BECB5E70E00D26570CAE1708F52DA91BE6EFD37170C0422A9557EB
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: aramcoasia.com
Sending IP: 5.79.121.92
From: Rika Tamashiro <rika.tamashiro@aramcoasia.com>
Subject: Pre-Alert// New shipment
Attachment: Pre-Alert.docx.zip (contains "Pre-Alert.docx.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 12:37:20 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6nlncjhtcsiighgipialoq2qkdyuzx4tz5suhpaus57hm4zaxuca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f356d124f31490831cc87a00b7435050f14cdf93cf6543bc14977e767320bd04

(this sample)

AgentTesla

Executable exe 8e6095d902b34ffac0a4121a61d97e80470f79d15938b1cd84de31b1777d611e

  
Dropping
MD5 a08144b4dea074e2cd2c27d2216983fe
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8e6095d902b34ffac0a4121a61d97e80470f79d15938b1cd84de31b1777d611e

Comments