MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec6241aa9bc5fd1596befd06fe76754d81b689cf2fe0d532c33a28629b9b349b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec6241aa9bc5fd1596befd06fe76754d81b689cf2fe0d532c33a28629b9b349b
SHA3-384 hash: 2bd9ae0f7b0284eac85448ace44753f176d182d162b0d7711dd51735e4dbe04cc49e0e9bc3e96cce8c76a0f9b0e60ade
SHA1 hash: 2cac06f35bf8a5ffb371d653cb87c102697ccd18
MD5 hash: 82b5091731cdeec5944c5a0a9e8cbc65
humanhash: stairway-india-happy-burger
File name:Documents.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:499'768 bytes
First seen:2020-06-02 11:44:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:tbirCbYeznM6yCCtZNLv0YVbQuMEy9eZTK1sZ:tbbYGnoCQZNTt8UZTesZ
TLSH F9B42320684C3FD072D97C79F6CA59A01AAC35458F74F61F908BE23399E64E173F5A09
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: medtekindia.net
Sending IP: 45.90.222.93
From: Silva David <anuradhad@medtekindia.net>
Subject: Please let us know what you think about the new corrected documents
Attachment: Documents.rar (contains "Documents.exe")

AgentTesla SMTP exfil server:
smtp.1and1.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 12:37:32 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5rredku3yx6rlfv67udp45tvjwa3ncopf7qnkmwdhiugfg43gsnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ec6241aa9bc5fd1596befd06fe76754d81b689cf2fe0d532c33a28629b9b349b

(this sample)

AgentTesla

Executable exe 38a112ac5ecf5d11e3e4f70fe462ec424bd0aa8c67495ac6744b0bbb8082f5ba

  
Dropping
MD5 774ce64540a4a68205bb30634225bef4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 38a112ac5ecf5d11e3e4f70fe462ec424bd0aa8c67495ac6744b0bbb8082f5ba

Comments