MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 067f023f1f965a6175dc20b232ad0c7fa0cd81d4337342d8f5bd9bb3f34d29de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 067f023f1f965a6175dc20b232ad0c7fa0cd81d4337342d8f5bd9bb3f34d29de
SHA3-384 hash: 1dccaac127541a0f257d0a65d5db289688a756252610e5ee705c3c009178c99ce7066741d9b19128406d54156d3444c1
SHA1 hash: 2eecc61744214fa3f25461929e31470303f83a19
MD5 hash: 06dddb379f90687e0a14a6d4b21f6775
humanhash: winner-sweet-twelve-cold
File name:Order Confirmation_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:299'312 bytes
First seen:2020-06-03 09:14:15 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:w2LlliBlsSOWT+duaGeH/AJOccVcXIvRJYX88Fn91:H5liUSOWT01GuhcYvRJ58FnX
TLSH 3A5423958BDE6BFAEAC885CF88EE575794B1961CC92D72133050B0D324BB7482B5D0CB
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email
From: Sales Manna <sales09@manna.corp.com.hk>
Received: from mailer11-2.incnets.com (mailer11-2.incnets.com [210.6.92.72])
Date: Wed, 3 Jun 2020 16:25:22 +0800 (HKT)
Subject: Confirming order
Attachment: Order Confirmation_pdf.gz

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 18:09:52 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=az7qepy7szngc5o4eczdflimp6qm3aougnzufwhvxwn3h42nfhpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 067f023f1f965a6175dc20b232ad0c7fa0cd81d4337342d8f5bd9bb3f34d29de

(this sample)

AgentTesla

Executable exe aed6b36153ae60bcade2c6368dbf8fd91a654e65475590d119283dd429e54da3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aed6b36153ae60bcade2c6368dbf8fd91a654e65475590d119283dd429e54da3
  
Dropping
AgentTesla

Comments