MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18679fa6e3a02dceda37e5e05651285ea9add33cc4fc5590b3177271fc36b1d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18679fa6e3a02dceda37e5e05651285ea9add33cc4fc5590b3177271fc36b1d4
SHA3-384 hash: 3a2162792e435ac142bb2acdc7cb248134494ec5e34327cf0cda6dd7ad507a41842dc8801052ea5dfec8a00a5d2fe05d
SHA1 hash: 92d740db16d0cc0c4bbafbfaf858ddec31199199
MD5 hash: e5871025eed1e3d02b73fc5acbf2cf46
humanhash: undress-network-black-arizona
File name:PROFILE.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:373'749 bytes
First seen:2020-06-29 15:40:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:bkaPOF/Kv5R2kO7ossTLys0Vy36CyIzPiTFy/WTwSs5Rory6GYa:QF/KRRhOp8huyKCFzKTg/WTwSsfea
TLSH B2842340FBE28F25E3B4299F1B4ED9D297C8F4079F29A678077F4101EAD7C6A1853815
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: elemsvalves.com
Sending IP: 37.49.230.119
From: "Saefudin" <info@elemsvalves.com>
Subject: RFQ#2201093
Attachment: PROFILE.zip (contains "PROFILE.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ENGK.190.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18679fa6e3a02dceda37e5e05651285ea9add33cc4fc5590b3177271fc36b1d4/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 15:42:04 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dbtz7jxduaw45wrx4xqfmujil2u23uz4yt6fleftc5zhd7bwwhka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 18679fa6e3a02dceda37e5e05651285ea9add33cc4fc5590b3177271fc36b1d4

(this sample)

AgentTesla

Executable exe ceb7dc735aad69ceaa69d7353b2364bbaf2ccd69176707bdc0d7c38f27e326b4

  
Dropping
MD5 0730a8b1cadc7b07bd0a7fbe57437939
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ceb7dc735aad69ceaa69d7353b2364bbaf2ccd69176707bdc0d7c38f27e326b4

Comments