MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16a2e259f1c62085bcce544d9222f79c3c3e9556d3e250a48805baa06eaedebb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 16a2e259f1c62085bcce544d9222f79c3c3e9556d3e250a48805baa06eaedebb
SHA3-384 hash: 102deeba7f3097078f3d3f6ee1604ab81a91a83d3023056f93b1155b5dba9dd9883c0ac06b9692e271d555f2858255d6
SHA1 hash: 0588ed7e1b10443b530d1aadde5c5b5905e26b06
MD5 hash: d364a82a48e33a6c5e2e35adc15c2168
humanhash: nitrogen-pizza-alpha-delta
File name:NEW PO_8956897020.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:617'864 bytes
First seen:2020-09-02 06:10:47 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:kGYxSgZXxp+A8KOu0Ah73hn5Rd+1DM9TemjaaIUjKdwf59wnk1/Un:kKgZXxT8K8AFPRd+1Dtw15+nk18n
TLSH 85D42347B483FE4206B5C8F7688A5AC64C7E558E9D27F4606FB02784837617E9C3B6C8
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx.itsource.com.ua
Sending IP: 91.197.146.118
From: c.a.manivanna@accenture.com
Subject: URGENT PO# 8956897020 TOS-00974
Attachment: NEW PO_8956897020.7z (contains "ei2gKB9pPLcdLie.exe")

AgentTesla SMTP exfil server:
mail.vinhphucpaint.com.vn:587

AgentTesla SMTP exfil email address:
su.tran@vinhphucpaint.com.vn

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/16a2e259f1c62085bcce544d9222f79c3c3e9556d3e250a48805baa06eaedebb/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-09-02 05:41:19 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c2roewpryyqilpgokrgzeixxtq6d5fkw2prfbjeiaw5ka3vo325q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/16a2e259f1c62085bcce544d9222f79c3c3e9556d3e250a48805baa06eaedebb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z 16a2e259f1c62085bcce544d9222f79c3c3e9556d3e250a48805baa06eaedebb

(this sample)

AgentTesla

Executable exe cc62fbe2f2d56489aa63caff47e0173e91ebd4ecd021d34aaa305c962006e880

  
Dropping
MD5 c9481a0ffc10d56ddd024e10b89fdad4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc62fbe2f2d56489aa63caff47e0173e91ebd4ecd021d34aaa305c962006e880

Comments