MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6979758a8f3ee8bbc26e57b9c4bd6eb02922e6ec6bf7abd1774e9c7a9e80687f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6979758a8f3ee8bbc26e57b9c4bd6eb02922e6ec6bf7abd1774e9c7a9e80687f
SHA3-384 hash: 12345c8b800ba0e8c05c70dd184ec55b2cec452358e9a94539425a2d9a51a5a71cfff5dcdab8677423f6c7c90621b5ff
SHA1 hash: c7f24a510a825d4bee5ab1dbdff34a523af687b8
MD5 hash: 388210aeaf8700f6cc544e8f981c350c
humanhash: august-uncle-uniform-summer
File name:Dekont.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:301'899 bytes
First seen:2020-07-16 07:17:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:2IupzeL/EaPoWDIqwA7Ub3NUSdHX0vX3m0GQ08fEBjmbN:2DpyLV0q4bdUO30vX3mxQ08sB+N
TLSH E054234ACBE5C4969C3FD52863D9839E5396CDC92D4916498838B0F38CD3C33AD9762E
Reporter abuse_ch
Tags:AgentTesla geo isbank TUR zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: isbank.com.tr
Sending IP: 45.153.241.46
From: Türkiye Is Bankasi <ortakservismerkezi@isbank.com.tr>
Reply-To: Türkiye Is Bankasi <ortakservismerkezi@isbank.com.tr>
Subject: Swift Mesaji 16.07.2020
Attachment: Dekont.zip (contains "Dekont.exe")

AgentTesla SMTP exfil server:
mail.decoplanet.net:587

AgentTesla SMTP exfil email address:
decoplanet@decoplanet.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.7136.13752.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6979758a8f3ee8bbc26e57b9c4bd6eb02922e6ec6bf7abd1774e9c7a9e80687f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 07:19:04 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nf4xlcuph3ulxqtok644jplowausfzxmnp32xulxj2ohvhuanb7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6979758a8f3ee8bbc26e57b9c4bd6eb02922e6ec6bf7abd1774e9c7a9e80687f

(this sample)

AgentTesla

Executable exe 01da17c9c2c55ea880f5f2d1d1b845d2f534b8fe411bc2ad18e4dba6e24a292f

  
Dropping
MD5 9e8bd6819de523a6012332c81f2b84e0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 01da17c9c2c55ea880f5f2d1d1b845d2f534b8fe411bc2ad18e4dba6e24a292f

Comments