MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac50fc69ac9ad2523992e4ee19ba7a84cac86ba26495ae1cfd2ae12abba6fb83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac50fc69ac9ad2523992e4ee19ba7a84cac86ba26495ae1cfd2ae12abba6fb83
SHA3-384 hash: 03d6c2d99c2e3278554ca93c09bc65b74c57cac2f4d549c114663952ba21db7a6097441222b3f7576927c4f3345a2064
SHA1 hash: 46efc452540bd3c771b61430a418a7e4e5f941cb
MD5 hash: e9727fddb9f6e59ed6ba8099cf35a959
humanhash: three-yankee-mexico-lima
File name:ztechprocurementorder.img
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'376'256 bytes
First seen:2020-06-16 05:46:03 UTC
Last seen:2020-06-16 06:19:42 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:ANXge4NdRMRoVWKnCfzpIKkfisevQqGkG/asSxYbKKBS:ANQesLMRo1+pIHipIqDG/+xW
TLSH 7255CF09F75BB631C19A41B4B9E3A25D8EE7BCD32A76DA063A44336EDA73381C50D305
Reporter abuse_ch
Tags:AgentTesla img


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bosmailout03.eigbox.net
Sending IP: 66.96.186.3
From: Khan Industries <anne-marie.campeau@exfo.cf>
Reply-To: exportscoin@gmail.com
Subject: Re: procurement NO 5678 2020
Attachment: ztechprocurementorder.img (contains "Order2020procure.exe")

AgentTesla SMTP exfil server:
smtp.mydomain.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.d63a69c988828726.24660.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:47:08 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vripy2nmtljfeoms4txbtot2qtfmq25cmsk24hh5flqsvo5g7obq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img ac50fc69ac9ad2523992e4ee19ba7a84cac86ba26495ae1cfd2ae12abba6fb83

(this sample)

AgentTesla

Executable exe 619751478ce61fb0e22bafd6335a970e33d359760bcf47cbb63c6a82f9e92648

  
Dropping
MD5 d63a69c988828726274ef01a4635f8d7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 619751478ce61fb0e22bafd6335a970e33d359760bcf47cbb63c6a82f9e92648

Comments