MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6befcdf2818c8ec03dd132213e4fcc916b3826f8941f1f38d707a45b7a2599c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 6befcdf2818c8ec03dd132213e4fcc916b3826f8941f1f38d707a45b7a2599c5
SHA3-384 hash: ee475fae1920f1b527c3836f69be533694c7f16bee2c70482664181c9b6231e6922c59fdd45add47a07797a4026b411b
SHA1 hash: 92bd970756536cf028c898520545d26baf45ad64
MD5 hash: 53508173e74029c1654a2fc28d27af27
humanhash: wisconsin-stairway-carolina-connecticut
File name:BL draft FORM_xls.rar
Download: download sample
Signature AgentTesla
File size:596'181 bytes
First seen:2020-07-31 10:04:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:NP/MXPwf/gbXl5e6m3CGktuxkBz9T8RgUp0JHOuhKtHj:NP/Lf/gbV5e6m3CGktWSNDhKdj
TLSH B8C423919A6D33CB46736CE2C0D6A5C7F949F59F884D0A85A3807EFFB42047501CAFA9
Reporter @abuse_ch
Tags:AgentTesla rar


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: kaidoo.cn
Sending IP: 172.93.187.232
From: raymond.he <raymond.he@kaidoo.cn>
Reply-To: raymond.he@kaidoo.cn
Subject: 回复:Re: 回复:Re: B/L draft FROM: Raymond.he
Attachment: BL draft FORM_xls.rar (contains "BL draft FORM_xls.exe")

AgentTesla SMTP exfil server:
smtp.moorefundz.com:587

Intelligence


File Origin
# of uploads :
1
# of downloads :
27
Origin country :
FR FR
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Status:
Malicious
First seen:
2020-07-30 23:36:13 UTC
AV detection:
15 of 31 (48.39%)
Threat level
  5/5
Threat name:
Kryptik
Score:
1.00

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 6befcdf2818c8ec03dd132213e4fcc916b3826f8941f1f38d707a45b7a2599c5

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments