MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3314edf5465af3d8be8e6ac4c6421e5028a85cc32ed19efca722ebadc5281e73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3314edf5465af3d8be8e6ac4c6421e5028a85cc32ed19efca722ebadc5281e73
SHA3-384 hash: 411000d158dc494e3ed94ca670192109e7847373568621b9c73ec03e3451c7ea9546034fb483d83e8d6a646f663dee0e
SHA1 hash: e03d91487788d3782ef32875b2a016015b57361e
MD5 hash: 6ac4d423033a39fbd5fbd83541b271fc
humanhash: arizona-glucose-mango-fifteen
File name:invoice copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:415'969 bytes
First seen:2020-06-18 09:47:55 UTC
Last seen:2020-06-18 09:58:07 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:iHi65nP4i1h1mApAnjheRn74hrYCAKoLTZdjOgQadQXILYWZN/LfJAslhcZiQY/r:Wi8nHpyheZ74RbA9LldjtNQhouyVT1
TLSH 7794230EF2E7E10279F907EA72485B45B44758F93693AE30F6C39DD9226AF16482C5CC
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: topcem.in
Sending IP: 103.253.125.212
From: electi@topcem.in
Subject: Re:Invoice
Attachment: invoice copy.zip (contains "invoice copy.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FakeAlert.9060.1798.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21447.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24066.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23810.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22851.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22964.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 10:37:10 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gmko35kgllz5rpuonlcmmqq6kaukqxgdf3iz57fhelv23rjidzzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3314edf5465af3d8be8e6ac4c6421e5028a85cc32ed19efca722ebadc5281e73

(this sample)

AgentTesla

Executable exe 8daf58146648177ecc0b8da2ee4068ef7886065792c7f6fa9eb03fc77c041e83

  
Dropping
MD5 0a50e12b8d562518d367ef31cc57cb27
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8daf58146648177ecc0b8da2ee4068ef7886065792c7f6fa9eb03fc77c041e83

Comments