MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63b7eef7d3ee93a921ba7c846d2051d74c42d86dc50b92a339353984b0554a18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63b7eef7d3ee93a921ba7c846d2051d74c42d86dc50b92a339353984b0554a18
SHA3-384 hash: f18fc2ef95b1f1e1f167d2acd19a107429c11e59149607dcd9086c0750ddc311d0ffe784fff74e3ac93631edd3294572
SHA1 hash: f3f982b714c3e51eed05775ff47378ae59de5d9a
MD5 hash: 729f4af4bf6ca02c94c625a735d4c084
humanhash: skylark-oscar-fillet-apart
File name:6月份副料請款明細 高士丰 - TAIEASY.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:464'802 bytes
First seen:2020-08-31 10:35:45 UTC
Last seen:Never
File type: zip
MIME type:application/x-rar
ssdeep 12288:yCvJ488vOev0qeX2D7vxritXm1BO8HdvSFWACFSY8ekVD:7xBzesX2hriqnHdV/FFkR
TLSH A2A4230B83EC1F53281B348A2095EAD47F81B32EBB58595415C42FB47A9E5F96DF0CCA
Reporter abuse_ch
Tags:AgentTesla geo KOR zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtp100.iad3a.emailsrvr.com
Sending IP: 173.203.187.100
From: Quynh Anh (Ms.) <lbenmamar@technisangles.fr>
Subject: RE: 6月份副料請款明細 高士丰 - TAIEASY (122614)
Attachment: 6月份副料請款明細 高士丰 - TAIEASY.zip (contains "6月份副料請款明細 高士丰 - TAIEASY.exe")

AgentTesla SMTP exfil server:
smtp.moorefundz.com:587

AgentTesla SMTP exfil email address:
evra@moorefundz.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63b7eef7d3ee93a921ba7c846d2051d74c42d86dc50b92a339353984b0554a18/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mo36556t52j2sin2pscg2icr25gefwdnyufzfizzgu4yjmcvjima._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/63b7eef7d3ee93a921ba7c846d2051d74c42d86dc50b92a339353984b0554a18

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 63b7eef7d3ee93a921ba7c846d2051d74c42d86dc50b92a339353984b0554a18

(this sample)

AgentTesla

Executable exe 4e9e93f2212fe68f3a0ffe0a1eb732413efd85cc3e94d6d62ebc9558dd8b957c

  
Dropping
MD5 81a9fd9492afb0f0d7bea535b1ef201a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4e9e93f2212fe68f3a0ffe0a1eb732413efd85cc3e94d6d62ebc9558dd8b957c

Comments