MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ba111a4b1fdc4fd69a85d1cc1b279c1074b086dafa6e26ab187286f8cc7ebe9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ba111a4b1fdc4fd69a85d1cc1b279c1074b086dafa6e26ab187286f8cc7ebe9
SHA3-384 hash: a134fd578a1a3c4a58ec51768c2c78def1adba8be3824f5831fc3a1d404bbeea9c019fb0ad5fc7cc4214ea42e967b782
SHA1 hash: ba88404ea592c06bae4a88a894f9439456d71cbd
MD5 hash: 0701c81f7a588b81c051d2c69714792b
humanhash: lion-football-oscar-east
File name:transfer copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:266'267 bytes
First seen:2020-05-25 14:10:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:EZjrHoIDYvP9eVDEd3v/7etsDTllMqLDsld+5M5wQwb7hO/:SD2vPC4d7eGXllMYD8DwQwb7hO/
TLSH 6844234F26B3E801A0DE5A255994648D06FF30BE9BBE41FC3C3A446DA9873E261514FA
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: telkomsa.net
Sending IP: 103.141.136.4
From: mahindranorthcoast@telkomsa.net
Subject: RE: PAYMENT INSTRUCTIONS
Attachment: transfer copy.zip (contains "transfer copy.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21037.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 14:30:08 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
19 of 47 (40.43%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1ba111a4b1fdc4fd69a85d1cc1b279c1074b086dafa6e26ab187286f8cc7ebe9

(this sample)

AgentTesla

Executable exe f982acad30d428f60d733fa6bd1bd13ebcdd8a8e0ae8711041e27f8bd70b527a

  
Dropping
MD5 926d9f5ea29e38dda301b7ea1286a5c4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f982acad30d428f60d733fa6bd1bd13ebcdd8a8e0ae8711041e27f8bd70b527a

Comments