MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e02cd1d1a26e955b3d66d447bb84dca232b547098502c69d896b38c71614c85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e02cd1d1a26e955b3d66d447bb84dca232b547098502c69d896b38c71614c85
SHA3-384 hash: bc7e3631f9481015832a745e85977a765a9a3e7fd84315c0f901d3ce1269b504c0398dd75c7e9530c8d433b6768cd3dd
SHA1 hash: 1fd5c0baa38f78a26f2960503177287425d331c6
MD5 hash: 7387105ae5ccf0cba4a8abcbd467ea9c
humanhash: eighteen-arizona-october-oscar
File name:GlobalOrder_T0028342005500.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:477'635 bytes
First seen:2020-06-02 08:16:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:FUeWC70bxwA9R2m19fW7UxRAHsgQbz3wy8lWe5LbsueI4E1N4O6Vk/K0B5Tp6zp:FNWC4NwgJ9e7Gw8b0WeVeI4E1mO64HAp
TLSH 2EA423414170C8673C6E46547EAA3B4BC4328E9BF5EAADEB1515A9087058C1FC8A37FF
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: c650.gconex.com
Sending IP: 190.9.37.45
From: Alicia LIAO <taink@fast.com.vn>
Subject: PO# T0028342005500 / SHIP / Globalegrow / 2020.6.01
Attachment: GlobalOrder_T0028342005500.zip (contains "GlobalOrder_T0028342005500.exe")

AgentTesla SMTP exfil server:
mail.sesan.com.vn:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 08:36:32 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nybm2hi2e3uvlm6wnvchxocnzirswvdqtbicy2oys2zyy4lbjscq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6e02cd1d1a26e955b3d66d447bb84dca232b547098502c69d896b38c71614c85

(this sample)

AgentTesla

Executable exe d60f774507ea86cf6fb6caec5bb930bc86ad5a38c9d9f72d568230580f02c92a

  
Dropping
MD5 444061aa3f4503ed0e8f1ab80cc6ec92
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d60f774507ea86cf6fb6caec5bb930bc86ad5a38c9d9f72d568230580f02c92a

Comments