MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffcb2695595edb1038f01ac39dc24830d955352ae9880f983ff2e22137357f18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ffcb2695595edb1038f01ac39dc24830d955352ae9880f983ff2e22137357f18
SHA3-384 hash: 943201381852f7f0c5f4a12ed177633214a6c865fc1fd06740668df308b11be2959d4e9dd707972d44ec6f034a0ded01
SHA1 hash: 03ff5973da6428080908426a3556d1ca935a548c
MD5 hash: 852239424be81f0464683f9dafade49d
humanhash: football-early-ink-johnny
File name:Purchase Order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:463'080 bytes
First seen:2020-08-18 11:47:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:TENA8Y2MTCush0Oc/LhXic1qvHse+bNZj86/ZzD:TENAR2U7FL/LhXKvHcv/zD
TLSH 64A4237693C27274765FC08324E7B96ADDD215448EC42C0A619ED384FCE02BDE939DE6
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: tecirler.com
Sending IP: 103.99.1.170
From: "finans" <finans@tecirler.com>
Subject: Re: Swift Copy For Purchase Order PSC1705935.
Attachment: Purchase Order.zip (contains "Purchase Order.exe")

AgentTesla SMTP exfil server:
mail.amexworldwide.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.20845.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ffcb2695595edb1038f01ac39dc24830d955352ae9880f983ff2e22137357f18/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 05:22:30 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=77fsnfkzl3nraohqdlbz3qsigdmvknjk5gea7gb76lrccnzvp4ma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ffcb2695595edb1038f01ac39dc24830d955352ae9880f983ff2e22137357f18

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ffcb2695595edb1038f01ac39dc24830d955352ae9880f983ff2e22137357f18

(this sample)

AgentTesla

Executable exe 66a821494ff2c4e9d5dbe663572f4f46df6993b0a661a29cd4a3da18414b9527

  
Dropping
MD5 8feb32e81b0c570b023e62ccaa62459b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 66a821494ff2c4e9d5dbe663572f4f46df6993b0a661a29cd4a3da18414b9527

Comments