MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e956f278d99bc1e9ccb0e947c4a01f1b385e182bad1c0a824f66d4273088c40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e956f278d99bc1e9ccb0e947c4a01f1b385e182bad1c0a824f66d4273088c40
SHA3-384 hash: f0ed821ff478985c69f0b948c158c94cd35073c5e1fbc2294b50ea5242f952ad9e630846f26cc041ef61471a788d6f47
SHA1 hash: c4c63a5d0e33597063dda1a1261a9e8a6fa2b746
MD5 hash: 9baef68a860c8e96d8a2a2a71e11cbee
humanhash: angel-asparagus-green-florida
File name:QUOTE 002242020.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:372'100 bytes
First seen:2020-06-21 07:09:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:7Du23iOIUZ7Op02NsW4K6yo44lobcA4HXVpRQ1efp0i+kpR3UbwkQSa1eH:Z3iOIiOScX4fn7ot43W+0U3gSoH
TLSH 4384233DF02918A82A89788C0F3740C5AEF9DDAE043E80E906C5F5B77F656BD61E2D51
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: kapgroup.in
Sending IP: 38.130.220.104
From: store7@kapgroup.in
Subject: Re; QUOTATION
Attachment: QUOTE 002242020.zip (contains "QUOTE 002242020.exe")

AgentTesla SMTP exfil server:
mail.standard-engg.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43368319.28141.26592.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-21 05:00:24 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2kw6j4ntg6b5hglb2khysqb6gzylymcxli4bkbe6zwue4yirraa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6e956f278d99bc1e9ccb0e947c4a01f1b385e182bad1c0a824f66d4273088c40

(this sample)

AgentTesla

Executable exe 79a5a1012a618aa8aeb77bc2742c11120634b0c5ad7bacdf37ee79aff484a6e4

  
Dropping
MD5 d7ad39b060b5353c18aca84d326c55e0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 79a5a1012a618aa8aeb77bc2742c11120634b0c5ad7bacdf37ee79aff484a6e4

Comments