MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f407aee7912c820228d9ef90e26dc52fec34309f0b03621c5fb9e762fa728bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f407aee7912c820228d9ef90e26dc52fec34309f0b03621c5fb9e762fa728bf
SHA3-384 hash: d4a6b6faf905facebf180bf1b15fa690650e55822e83194b43c0a57633e84f4e20a6e43faa8237dc080bfb53cb3533a3
SHA1 hash: b9026955644dc40e5166a1bcea9115909a257ef8
MD5 hash: 9b1005754274344ebb22410f2c3469d3
humanhash: east-jupiter-cardinal-sixteen
File name:235680-950823.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'158'225 bytes
First seen:2020-05-28 11:42:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:xFJHl5JYBjlfOTzsm28gVfX6hFhCGOV2iAMpYORiSl+eoh:xFJHlfYBoT4Uy6nk7xpYORiSo
TLSH C135332DB5C04D7C636727787592C2AA50C7BC1F33EFC84A63E0D9174EAA6A0876531B
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: masycproject.com
Sending IP: 103.99.1.147
From: VISHAL KAPOOR <v.kapoor@masycproject.com>
Subject: RE:OFFER FOR EVEREST MAKE AIR BLOWER - SA CONTROLS
Attachment: 235680-950823.zip (contains "235680-950823.exe")

AgentTesla SMTP exfil server:
mail.pptoursperu.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27681.XorExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 12:36:41 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6f407aee7912c820228d9ef90e26dc52fec34309f0b03621c5fb9e762fa728bf

(this sample)

AgentTesla

Executable exe 82f23fef0eae1ad31ac9e0dd78819572c793ff9b243ddfaa37b3447d74f852e4

  
Dropping
MD5 1ba36555679010962791afa4d898fcff
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 82f23fef0eae1ad31ac9e0dd78819572c793ff9b243ddfaa37b3447d74f852e4

Comments