MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3cfe6f97e3b9ffeeebd670f673e32a9742beaf718d1d67a86fb5e17f77b5527. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3cfe6f97e3b9ffeeebd670f673e32a9742beaf718d1d67a86fb5e17f77b5527
SHA3-384 hash: 2757eab83c118e1d5090c57fa7f62ae86b50d2b204278238ccc3a57156876b4ee4cc1b25d20367fc85162bb4bafcbd97
SHA1 hash: 38b545cfbbc77ca21950554db4ee0a7d0ad067d1
MD5 hash: 33dbb3bc18d46aa139868fa940843f99
humanhash: earth-wolfram-coffee-skylark
File name:DRAFT BL INVOICE + PACKING LIST.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:554'355 bytes
First seen:2020-05-04 18:02:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:mT+kRbP1z8/VXxYf4E4n813yqyaxrfc3vLQCaiJot0L:mT+kRbqPV+1i28cCa56L
TLSH E5C42394F300E6A9F4130DC7016D3A3C88639A9CA82B64DDC3A07BF5786647F9E5652B
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: amhserver4.com
Sending IP: 85.214.43.178
From: sales02 <info@khirtacon-dz.com>
Subject: Re: DRAFT BL/ INVOICE + PACKING LIST
Attachment: DRAFT BL INVOICE + PACKING LIST.zip (contains "DRAFT BL INVOICE + PACKING LIST.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.416781.23837.8188.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 12:15:59 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yph6n6l6hop753v5m4hwoprsvf2cx2xxddi5m6ug7npbp533kutq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c3cfe6f97e3b9ffeeebd670f673e32a9742beaf718d1d67a86fb5e17f77b5527

(this sample)

AgentTesla

Executable exe 060a16518824101a132d9816abde0b03fec08b29beb9415c217ec0e1f2cf7793

  
Dropping
MD5 3852dae640e3aace3c5a3d9740019e3f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 060a16518824101a132d9816abde0b03fec08b29beb9415c217ec0e1f2cf7793

Comments