MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ec6d14dd19f465eae2c28c9ce93528fc53045aa223d24ae700946b83c134cf4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ec6d14dd19f465eae2c28c9ce93528fc53045aa223d24ae700946b83c134cf4
SHA3-384 hash: ba141c4031e15093a8c103e8d408c43bcbad1b077b09f14db6f0d26483c13cbdfcbb01b5bab2a358a183a33abaefc7ce
SHA1 hash: 3be9b06e9a0d6ee2cb163d38af44d7280ca17949
MD5 hash: 3300d6c828b3d08fee8c0a0cb526df92
humanhash: batman-twenty-mobile-bacon
File name:PO443RF.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:672'716 bytes
First seen:2020-07-08 05:46:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:xsiCoKzZwDNd5VZpejyQr/FrPOEYYIfWi6O23hZL:mi+z6NVylFr2bYIfWK2zL
TLSH C7E423DF1E2CD2458F3D0AD2A5F6172C280C9D2B6F8D261BFBE26214D3772634128769
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: api.genarelgroup.com
Sending IP: 64.225.37.105
From: Daan Sluis <info@genarelgroup.com>
Subject: PO_287109139
Attachment: PO443RF.zip (contains "PO443RF.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ec6d14dd19f465eae2c28c9ce93528fc53045aa223d24ae700946b83c134cf4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 05:17:52 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d3dnctort5df5lrmfde45e2sr7ctarnkei6sjltqbfdlqpatjt2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1ec6d14dd19f465eae2c28c9ce93528fc53045aa223d24ae700946b83c134cf4

(this sample)

AgentTesla

Executable exe 879f98e73afed5c6189c48268f35e2ee021df914e2e612b7568ae1eb4c5f5d16

  
Dropping
MD5 dad65c4b9cff677b083a3a49d908ae3f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 879f98e73afed5c6189c48268f35e2ee021df914e2e612b7568ae1eb4c5f5d16

Comments