MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60f9895024464e0eed31721aa325a5b35928130426c1b6e9a5c94c975c1f5f3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60f9895024464e0eed31721aa325a5b35928130426c1b6e9a5c94c975c1f5f3b
SHA3-384 hash: e09b065bbb2f1c2e62c86875102fdc3c20bea06e4bf09e0bb5f5889a75969a59b65920ce6d4c4ea0a638bfbe69da5b6c
SHA1 hash: 4696615e9986b014a409f04867dea89ebd455217
MD5 hash: 12620c8218531226bd7a1e2ad3cca4a9
humanhash: illinois-ceiling-thirteen-mockingbird
File name:Invoice_9838478282GM.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:354'756 bytes
First seen:2020-05-26 13:30:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:M7TXEFfwlFwUVxbY3nWSzt1JkScSOzeynzy0jPNfiI7yErej1DdTUMaqfK:MHAernY3WSzHiPSOznzy0pfjWErepdoT
TLSH 3C7423D7E621EF4AF5B2C4CE498A3D584C2506AFCBA74A6B441B0A681D2F3D5E500C6F
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: masterall10.rapidns.com
Sending IP: 180.149.242.95
From: <exports@inmaenterprises.com>
Subject: Re:ENQUIRY # Order
Attachment: Invoice_9838478282GM.zip (contains "Invoice_9838478282GM.exe")

AgentTesla SMTP exfil server:
smtp.stlia.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25090.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 13:36:24 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 60f9895024464e0eed31721aa325a5b35928130426c1b6e9a5c94c975c1f5f3b

(this sample)

AgentTesla

Executable exe c1ff5f89e94bcbda118414682143c52eb8547c620bc32518172c7d3cf471ef14

  
Dropping
MD5 0fe2d4ffeaf2ba801382b42b0af320ae
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c1ff5f89e94bcbda118414682143c52eb8547c620bc32518172c7d3cf471ef14

Comments