MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f634a9d7eaeb9dcdefff98bfe6a850190c16dd9ab8a2e50fee3fa5acf5757a14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f634a9d7eaeb9dcdefff98bfe6a850190c16dd9ab8a2e50fee3fa5acf5757a14
SHA3-384 hash: ab174d8275e2c7a9fb0cfec788d87c843fe1af7e8917af61a5d2955467dd8cde8fa1d439271ebfe1db98081605af436d
SHA1 hash: 84fe0d182c9e362763fca61948e98de49e1bb6f1
MD5 hash: 50f922cbe8b8e426906c0975945f3da8
humanhash: victor-december-pasta-early
File name:Shipment Details 2.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:474'333 bytes
First seen:2020-05-06 19:03:11 UTC
Last seen:2020-05-07 10:26:39 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:D3sRDUV0Qh1obEteB/M/3mPyMk5MLyNK6BXzFEFIp:TsqVJh6otW/M/WPR/WNtsIp
TLSH B0A433603C5AB4EF5C02193F28E56513769E236AC620A3A613330A7B69F357F1FD9C16
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: kuehne-nagel.com
Sending IP: 103.99.1.174
From: emre ferik<emre.ferik@kuehne-nagel.com>
Subject: RE: Serra Sponge / Ashdod 1x40hc. Wednesday 6 may 2020
Attachment: Shipment Details 2.zip (contains "duk (3).exe")

AgentTesla SMTP exfil server:
mail.hotel71.com.bd:587

Intelligence

File Origin
# of uploads :
3
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.hc.29078.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 19:37:47 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6y2ktv7k5oo43377tc76nkcqdegbnxm2xcrokd7oh6s2z5lvpika._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f634a9d7eaeb9dcdefff98bfe6a850190c16dd9ab8a2e50fee3fa5acf5757a14

(this sample)

AgentTesla

Executable exe bbfd3959ef22e9fa18ed11cbc9b8f31ac36e86f0d055d2c57b81ee19f9c54175

  
Dropping
MD5 04b191c4242a98c5b14ed1de9c61ef8c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bbfd3959ef22e9fa18ed11cbc9b8f31ac36e86f0d055d2c57b81ee19f9c54175

Comments