MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82bc2cc15608c16cda9275cda17a4a88727afb74e621e8bf48fab6cc550c51fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82bc2cc15608c16cda9275cda17a4a88727afb74e621e8bf48fab6cc550c51fa
SHA3-384 hash: 013c5256a9d55fed894790cb9a80e148292abb3eeeb91a66ced9d02ac14aa1dff2da4aff170cc1e171d2fc40361b14d3
SHA1 hash: bb381965768d793474c677a8f24224576372c396
MD5 hash: f710f3747b0c6d05808073892b04a723
humanhash: cardinal-utah-blossom-edward
File name:STATEMENT OF ACOUNT.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:388'713 bytes
First seen:2020-06-26 07:43:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:/8+60EtNgWQFQnCBJbVY8rfZLXwyjPIfVhDhmR3LMoWC8FSEA/o2ldeZ473u:/8D0yC7VZlLXjLIf/ToWC8FShDlgZ4a
TLSH B084235ED98888DAB16108D751F8A4C2D14CAE4AF27920771871DFB36BF41B0587FA3B
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.o-g.me
Sending IP: 164.68.104.12
From: finance <m.ababneh@hosbanclearance.com>
Subject: STATEMENT OF ACCOUNT
Attachment: STATEMENT OF ACOUNT.zip (contains "STATEMENT OF ACOUNT.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:5

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.d72f02436bb252e3.2121.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82bc2cc15608c16cda9275cda17a4a88727afb74e621e8bf48fab6cc550c51fa/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 07:45:06 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qk6czqkwbdawzwusoxg2c6skrbzhv63u4yq6rp2i7k3myvimkh5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 82bc2cc15608c16cda9275cda17a4a88727afb74e621e8bf48fab6cc550c51fa

(this sample)

AgentTesla

Executable exe ad47a95274571e9bb73b9afeea618dbbbcf5c859b422b14a5d307116d98b7f9f

  
Dropping
MD5 6fae939d76ab9abe06aad0daf078f86b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ad47a95274571e9bb73b9afeea618dbbbcf5c859b422b14a5d307116d98b7f9f

Comments