MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0634676b3c100574d8507f5146cf3c5a5e76858b9e0b680801d86fb5bc5fa456. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0634676b3c100574d8507f5146cf3c5a5e76858b9e0b680801d86fb5bc5fa456
SHA3-384 hash: bd8771c13894045a5eb40f7e9816d4c513784e6e0ec350f10f0d9d88aa7269d26ad068b1de3276247439457d3857e23f
SHA1 hash: 3a93ede1e0302f14ffd544412b82d24c4f1c5263
MD5 hash: b493f08a2989b26a2ba694c94dbf1a2c
humanhash: india-floor-stairway-batman
File name:SPECIFICATION AND EGYCO TENDER DOCUMENT.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-19 14:43:38 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:H8aEYehgvVMBFH43e5KU+Z04DMR+hk5xD1T2fwUZNY0TIAj0+2WdMUF4lo4HJIh:cXThaolDUjZlDIUk5BcwUZLUAjDG9
TLSH 6D452226479A5B5BE6BD08B80016E1B591E1CC4225A1F36FFDDC8CFFB793B4A2B54120
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: DS7919266.clientshostname.com
Sending IP: 185.180.198.157
From: EGYCO LLC <brightli201@gmail.com>
Subject: RFQ - EGYCO LLC TENDER DOCUMENT
Attachment: SPECIFICATION AND EGYCO TENDER DOCUMENT.IMG (contains "TENDER DOCUMENT OF EYGCO LLC PROJECT.exe")

AgentTesla SMTP exfil server:
mail.mfs2u.com.my:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0634676b3c100574d8507f5146cf3c5a5e76858b9e0b680801d86fb5bc5fa456/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 14:45:09 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ay2go2z4cacxjwcqp5iuntz4ljphnbmltyfwqcab3bx3lpc7urla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0634676b3c100574d8507f5146cf3c5a5e76858b9e0b680801d86fb5bc5fa456

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 0634676b3c100574d8507f5146cf3c5a5e76858b9e0b680801d86fb5bc5fa456

(this sample)

AgentTesla

Executable exe 2e26f3d20d246b10bfabfceb33cbfd707049377dc821e2cd4ef9f77ab599693d

  
Dropping
MD5 98a6112ed9f13e4b4bfd8d9f2decd5dd
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2e26f3d20d246b10bfabfceb33cbfd707049377dc821e2cd4ef9f77ab599693d

Comments