MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06e32937444cad24306cd4020ba596618315a1329d0f6cc1aebdc8f9f2ed1dc7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06e32937444cad24306cd4020ba596618315a1329d0f6cc1aebdc8f9f2ed1dc7
SHA3-384 hash: f282e66042e562c821e484cdea288b1050a81b306118ed615b8e3c0c3a3c0aa9c30e986b10116af58f325f38f535a02d
SHA1 hash: 961c368a240b252e4c58f86ba7e00c1d2e350783
MD5 hash: 66123c09c94b8b813b0fa552e16a3fad
humanhash: lion-stairway-edward-uniform
File name:transfer copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:388'205 bytes
First seen:2020-05-26 10:46:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:x6Hhvx0jIRnYCyN87EHOevzlIBbJd41wzvkMRESrwGBp3M0BDaqGPl:x6ojcYTCGZvzqC0HREQXM0BOqGt
TLSH 8884233744C5E4F1EACBEC62869CAD8F188585DC5F8905DEBC920E95AD303FF2859E90
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cyber.net.pk
Sending IP: 103.141.136.4
From: technomerchant@cyber.net.pk
Subject: RE: PAYMENT INSTRUCTIONS
Attachment: transfer copy.zip (contains "transfer copy.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21037.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 12:48:58 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
21 of 48 (43.75%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 06e32937444cad24306cd4020ba596618315a1329d0f6cc1aebdc8f9f2ed1dc7

(this sample)

AgentTesla

Executable exe bc7796f8bd7d5a36829a8cb64edac24a195ba0887053f90ca0d74899ed9a4d3c

  
Dropping
MD5 551285c43af035791a7d1dd2b6a5d3b3
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bc7796f8bd7d5a36829a8cb64edac24a195ba0887053f90ca0d74899ed9a4d3c

Comments