MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c62ca6d2747a54ac6dc5ea5f924278a1978d1c135d1c6ea4a17f56263efe297. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c62ca6d2747a54ac6dc5ea5f924278a1978d1c135d1c6ea4a17f56263efe297
SHA3-384 hash: 30a25ba3a3776a9cf23c43f1c88ec9f5b02e75d8047d524c6787c59ebb20940ff066597dad1215f53530c79e535b0529
SHA1 hash: 3e80626a6169846d3af989f959b3a3293946a398
MD5 hash: 67fbe63880688948e583e8550fb9d5e1
humanhash: green-monkey-river-diet
File name:QUOTATION27052020A_NEW_OFFER_SAMPLE_MATERIAL_ELLETRON_IntlCas.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:409'613 bytes
First seen:2020-05-27 08:50:31 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:6F68gpz1P0NLSWRKKkhcHXhAQpGbkm5k6E+OHng:pNz1eHTXh+FE+OHg
TLSH 7F9423C73384DC9DCC5BC69C347B9BCE887363691F2144981BA28F249457FD962E50AA
Reporter abuse_ch
Tags:AgentTesla arj


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: infohelpdesksvc.pw
Sending IP: 173.82.235.143
From: Elaine Tang <info@infohelpdesksvc.pw>
Subject: OFFER AND QUOTATION
Attachment: QUOTATION27052020A_NEW_OFFER_SAMPLE_MATERIAL_ELLETRON_IntlCas.arj (contains "QUOTATION#27052020A_NEW_OFFER_SAMPLE_MATERIAL_ELLETRON_IntlCas.exe")

AgentTesla SMTP exfil server:
smtp.csmilferaft.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 09:03:37 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

arj 1c62ca6d2747a54ac6dc5ea5f924278a1978d1c135d1c6ea4a17f56263efe297

(this sample)

AgentTesla

Executable exe eade8da959aed5cdba82450919b4c655a2ad862ed362bbffdb2633b3bb024a2a

  
Dropping
MD5 6f08331c0c031f52b9db7e40ce234c25
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eade8da959aed5cdba82450919b4c655a2ad862ed362bbffdb2633b3bb024a2a

Comments