MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2cb2ef7a35837a0b29e7447b290b20cacb2d176929d4924bc4273e819f2d7a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2cb2ef7a35837a0b29e7447b290b20cacb2d176929d4924bc4273e819f2d7a9
SHA3-384 hash: 5df0e58230d9bd9656b1acea5745dc56811c0883ae644cca869ce02b95dc32886c2b80f08b49f7f6e24eab3fb2932ead
SHA1 hash: 7b2f87faf9964b870dfa793d055355460479eb57
MD5 hash: 9f8ca296ad49fdef5ef1eda60fc61ec2
humanhash: mirror-march-tennessee-virginia
File name:attachments.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:422'162 bytes
First seen:2020-04-27 05:37:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:jzTOFW3rb7UpLo5i6SHCFNx9Z0gK6C4UITkKAdDux:jzT17PUp6iUXxX0gb1TTkfe
TLSH D19423F89158686FC4204406ABDA97418B7A330D3DA34E5FB7A5E2DED35FFC9108852E
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email
From: medikascientific<info@medikascientific.com>
Received: from medikascientific.com (unknown [103.89.89.197])
Date: 26 Apr 2020 19:11:09 -0700
Subject: RE: Invoices
Attachment: attachments.zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33731281.10769.20676.UNOFFICIAL
Create hunting rule

Win.Packed.Agenttesla-7732321-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-27 06:35:28 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6lfs555dla32bmu6ord3fefsbswlfulwskousjf4ijz6qgps26uq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f2cb2ef7a35837a0b29e7447b290b20cacb2d176929d4924bc4273e819f2d7a9

(this sample)

AgentTesla

Executable exe 721d621d895199358641b0e95c31e543ce050ad4447f8f2255bb9f9c110e1c93

AgentTesla

zip 9cde5f0fa58ea29f9560c2535c925c5fa7cf1088686e9e81caba30fc3b6ba875

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9cde5f0fa58ea29f9560c2535c925c5fa7cf1088686e9e81caba30fc3b6ba875

Comments