MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c8214b2022e4e65aaf390b87f9b343dc259b16fc87632611062e005ff74be40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c8214b2022e4e65aaf390b87f9b343dc259b16fc87632611062e005ff74be40
SHA3-384 hash: c18b38bf74a5469e78612e465ec55a7d13609045ee69b7e65a5c17034093648c1305f45ca99426e08c97939d3f7c3826
SHA1 hash: 31f3afc660d6094159850b05d42c011386ca017b
MD5 hash: bd065c8b599a9b244398ad890ffafa43
humanhash: freddie-nineteen-oscar-twelve
File name:Wellmien_Product_Sample_.ra.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:395'695 bytes
First seen:2020-04-02 08:41:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:RlcSGpH20t7GXFVKwddb5uX/vxtYZ72xAuPz:Rl3GpW0t7IFIwddcxuZaSu7
TLSH 168423DB0F996BC267557B0BAE9C4D824510F06B260497100ECECB9BA3E5FE319F60B1
Reporter abuse_ch
Tags:AgentTesla COVID-19 zip


Avatar
abuse_ch
COVID-19 themed malspam distributing AgentTesa:

HELO: mail.mallofmysore.com
Sending IP: 203.185.191.111
From: Grace Liu <grace@wellmien.com>
Subject: Fwd:Wellmien COVID-19 Supplies (Masks, Gloves, & other products)
Attachment: Wellmien_Product_Sample_.ra.zip (contaisn "Wellmien_Product_Sample_.ra.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Nanocore.23.14368.24821.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-02 09:35:27 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
21 of 46 (45.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nsbbjmqcfzhglkxtsc4h7gzuhxbftmlpzb3deyiqmlqal73uxzaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6c8214b2022e4e65aaf390b87f9b343dc259b16fc87632611062e005ff74be40

(this sample)

AgentTesla

Executable exe b0a31d8b0c77ceaf0778cb4eaac32a36ed92dd93bb6c1163e85326d75c4fb550

  
Dropping
MD5 fde338d00a6651405ad7c0fbc30ceda4
  
Dropping
SHA256 b0a31d8b0c77ceaf0778cb4eaac32a36ed92dd93bb6c1163e85326d75c4fb550
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b0a31d8b0c77ceaf0778cb4eaac32a36ed92dd93bb6c1163e85326d75c4fb550

Comments