MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f167b327fa73b545d2717af99b726cac031eac766fcf76c2e34228835211aca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f167b327fa73b545d2717af99b726cac031eac766fcf76c2e34228835211aca
SHA3-384 hash: 79935a7f434f2f24eec8e94862cf26276b291730a1f5fb8359dc29f33907e20d9d4252b51ebb7b1ace5699cd560c5506
SHA1 hash: 20e36f9096f83961a5f1d1f4f8575917888dcddc
MD5 hash: 424f69fc8500a40bf396afc978cf3773
humanhash: may-ack-texas-lactose
File name:PAYMENT TRANSFER SWIFT copy 01-06-2020 .pdf.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'441'792 bytes
First seen:2020-06-01 11:30:21 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:PSl4s4P3Zk9L2GxjmPo0rHHglwB2u/bO3Dva7VJZOUb1sp3kIDmWfNTJdPt7Rd7T:P8qPm9L7mA0rHAlCPK3D0/hbGp3kwHS
TLSH 0D656D59336072EEEB73E0F2CD5C2D64E520E8FF874AB50A6313356A5A1C452DE360B6
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: citi.com
Sending IP: 103.141.136.136
From: Capellan, Miguel <miguel.capellan@citi.com>
Subject: RE: Advise Payment Transfer Swift copy Bank
Attachment: PAYMENT TRANSFER SWIFT copy 01-06-2020 .pdf.img (contains "PAYMENT TRANSFER SWIFT copy 01-06-2020 .pdf.exe")

AgentTesla SMTP exfil server:
mail.jaccontracting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 11:35:40 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n4lhwmt7u45vixjhc6xztnzgzladd2whm36po3bogqriqnjbdlfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 6f167b327fa73b545d2717af99b726cac031eac766fcf76c2e34228835211aca

(this sample)

AgentTesla

Executable exe e0ff2d17640f73176f1f678d9ab6f453991d8f741a12a98abd0e0665d21cd7be

  
Dropping
MD5 6ab17e0cbe77fe7fb4525961a977c132
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e0ff2d17640f73176f1f678d9ab6f453991d8f741a12a98abd0e0665d21cd7be

Comments