MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c6b153e82fb772716fa05d2ccb089a3429918796e00af815afb389f5290dc8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c6b153e82fb772716fa05d2ccb089a3429918796e00af815afb389f5290dc8e
SHA3-384 hash: 595ade015736a297f0cb6e372eaaa645224f54368245469fd34c2a7ebd0e85f3e9ca9836b01d8fbc753f10133c2e24d4
SHA1 hash: 80b6632606bb09db6d0a8a961a18d18c956a2520
MD5 hash: eb1eb69f6736e3e809548acc76f41a80
humanhash: lake-july-wyoming-music
File name:scan-16bi.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:498'777 bytes
First seen:2020-08-06 05:23:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Ohc0S4AGXEIL7hWz7itZm2BV1lis9m1iZESnZ:OO0tXXvhT/m2LqKvKSnZ
TLSH 4CB423140EFA8D64E87102CB419AD7DB82BD60431DDE5F1F6FAB34D1A269B8198C52FC
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.yougurnu.com
Sending IP: 104.168.172.35
From: info@yougurnu.com
Subject: FW: RE: R29011CA !! Please reply ASAP
Attachment: scan-16bi.zip (contains "scan-16bi.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c6b153e82fb772716fa05d2ccb089a3429918796e00af815afb389f5290dc8e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:25:11 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=drvrkpuc7n3sofx2axjmzmejunbjsgdznyak7ak27m4j6uuq3sha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/1c6b153e82fb772716fa05d2ccb089a3429918796e00af815afb389f5290dc8e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1c6b153e82fb772716fa05d2ccb089a3429918796e00af815afb389f5290dc8e

(this sample)

AgentTesla

Executable exe cf569e5361d68bca55156e7931606bd5acea860b5824dda249285c824ee32aa6

  
Dropping
MD5 c56df89af973bf7eae6ad4d5410674ae
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cf569e5361d68bca55156e7931606bd5acea860b5824dda249285c824ee32aa6

Comments