MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 600f5bfe769b49999efea99ae16dcbe77b72bb2bc8cef18d27e77b3da2610ab7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 600f5bfe769b49999efea99ae16dcbe77b72bb2bc8cef18d27e77b3da2610ab7
SHA3-384 hash: d38b46cf8e278da807c2ae4641ef3e73f62d838072e4873d562821ce250fd62bef5cc95832b7e1e782ad1f9fe4b034a0
SHA1 hash: 77133836dd39bc088139ceee17365509d82f473a
MD5 hash: b41682ceb1888180fbcac7e8b4cb589e
humanhash: winter-whiskey-twenty-wisconsin
File name:RFQ#78-02062020.IMG
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-02 16:33:33 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:KS39wZdN9/qMtMt1s9Lh6pjXbzBPKD5M3Y4VUpXUVfW:KS3aL9/B9Lh6ZXBPiM3YcUVUVu
TLSH ED45CF39B3A8CA67D5ADC278C0C1410587E2D1AF658FE7C6F4E5A4F1275B37289022B7
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: dedi-146748.mx1server.com
Sending IP: 162.214.70.236
From: Angelina <Inquiries@verventrading.com>
Subject: RFQ#78-Urgente
Attachment: RFQ#78-02062020.IMG (contains "RFQ#78-02062020.scr")

AgentTesla SMTP exfil server:
smtp.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 16:36:01 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mahvx7twtnezthx6vgnoc3ol455xfozlzdhpddjh455t3itbbk3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 600f5bfe769b49999efea99ae16dcbe77b72bb2bc8cef18d27e77b3da2610ab7

(this sample)

AgentTesla

Executable exe ee5d2dab2b72605b3d092c5881f8485a26b8725c70a9fb77f733209e30099463

  
Dropping
MD5 7c0111d69c60338dd71da016e586f019
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ee5d2dab2b72605b3d092c5881f8485a26b8725c70a9fb77f733209e30099463

Comments