MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6e608de417c7e4e4e693353a1a84920591e872cefcb27e0d93ef6b97a133481. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6e608de417c7e4e4e693353a1a84920591e872cefcb27e0d93ef6b97a133481
SHA3-384 hash: c1bb0878aee43ad673e405d3a2601987204cf3fa8fdcd8592204dce3d319fa7062c38b772f065e3ce5824423f21c667f
SHA1 hash: bd372763b76239a24568cf03d6dd8552aca27e10
MD5 hash: 914f44b34218cf5196ff2c0ac3362653
humanhash: snake-coffee-avocado-lactose
File name:INSTRUCTIONS COPY.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:529'276 bytes
First seen:2020-08-06 05:52:51 UTC
Last seen:2020-08-12 11:56:31 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:oAtA3mcvSUKFoz1piSk/BmKtScUiIE4gVfcLu:D5cqUKO/iNmKMcyE4Sfl
TLSH 31B42394D0D70B2AF2F3D51B7989B4A379CC47728919D1B49BECA6609F7BA21CD007C2
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: belina.co.cr
Sending IP: 95.211.208.49
From: facturacion@belina.co.cr
Subject: RE: PAYMENT INSTRUCTIONS
Attachment: INSTRUCTIONS COPY.zip (contains "INSTRUCTIONS COPY.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f6e608de417c7e4e4e693353a1a84920591e872cefcb27e0d93ef6b97a133481/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:54:07 UTC
File Type:
Binary (Archive)
Extracted files:
34
AV detection:
22 of 29 (75.86%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=63tarxsbpr7e4ttjgnj2dkcjebmr5bzm57fspygzh33ls6qtgsaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f6e608de417c7e4e4e693353a1a84920591e872cefcb27e0d93ef6b97a133481

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f6e608de417c7e4e4e693353a1a84920591e872cefcb27e0d93ef6b97a133481

(this sample)

AgentTesla

Executable exe 582bb52402f47d9d47b4c786419e32e60a19ae400fdf59654218d6fff01edab2

  
Dropping
MD5 1d60d25de052afc103404099266f057b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 582bb52402f47d9d47b4c786419e32e60a19ae400fdf59654218d6fff01edab2

Comments