MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6036d442aaa5897a1dfba3d25e58674bf41b6071e4ee084c95155f85155bd367. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6036d442aaa5897a1dfba3d25e58674bf41b6071e4ee084c95155f85155bd367
SHA3-384 hash: 01093574de506c4b029c08444d0c3860251bf3e4f657322d9ebaddae4ce4168186207c99c47735cac0006e57f38209a0
SHA1 hash: dd43eec40334ebf304a247b522c1515837a6edd2
MD5 hash: e06f7d9d3441b2c318811fe6a793a315
humanhash: eighteen-rugby-pizza-nuts
File name:Image_001 And Price List.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:270'309 bytes
First seen:2020-05-25 12:32:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:uX2+C+PpFW+QSmg5zVFTl3gw5YnAGcWPNQjvVhncuIkKFkMoMO4a1:gavaH1gzVjlwrnmMV1
TLSH C44423D4FA620E094D339FBF395D617523315A37199E4668AAAC4FDE418B7018F30E4B
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cloud.criticalserver5.net
Sending IP: 140.82.30.135
From: humberto.elizondo@bwplazamonterrey.com
Subject: RE:REQUEST FOR PRICE LIST
Attachment: Image_001 And Price List.zip (contains "Image_001 And Price List.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23534.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 12:36:58 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6036d442aaa5897a1dfba3d25e58674bf41b6071e4ee084c95155f85155bd367

(this sample)

AgentTesla

Executable exe 527555188f02e34c2da78b96f9573fbd10dd3231f76163aefedbe5b309119b24

  
Dropping
MD5 3e9218eecc9335c4546eae2ae8d9117c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 527555188f02e34c2da78b96f9573fbd10dd3231f76163aefedbe5b309119b24

Comments