MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c05d9624b9b0d4da4e006bfd2300446ef5caeb269ad1c2ab223d5af25d837fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c05d9624b9b0d4da4e006bfd2300446ef5caeb269ad1c2ab223d5af25d837fe
SHA3-384 hash: cea5712709c9452f5934a15621b4ec6f7cd0729769e691d4a0b03a3bf7efae9202568515a3e588d40a998e6f8e2abb91
SHA1 hash: adc4ba3fa6fc1a6458d96afd10ac919938eb829a
MD5 hash: 4b7272b5b1d492c7323922690107b5c8
humanhash: fanta-high-high-three
File name:Spec9837.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:334'500 bytes
First seen:2020-05-28 06:32:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:C+sf0vSHZTJ5R77xPIjrz+xYmnVPhoTGZvs9pmeBZsRg0MlBWutRwEWiFhL2gvtv:qTJ5Uj+xZ9hWG+pKJMlBWuDWgLlI0EK
TLSH 436423808A4739BBC7A9B74B0498D8ADD0193801927975DBE3ABB46903375DFF02D4ED
Reporter abuse_ch
Tags:AgentTesla Yahoo zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic307-37.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.190.60
From: Mauritius Kaiser <alexandy40@yahoo.com>
Reply-To: Mauritius Kaiser <alexandy40@yahoo.com>
Subject: Re: Request for quotation
Attachment: Spec9837.zip (contains "Spec9837.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.fc.14477.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 06:36:53 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
18 of 48 (37.50%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6c05d9624b9b0d4da4e006bfd2300446ef5caeb269ad1c2ab223d5af25d837fe

(this sample)

AgentTesla

Executable exe d38ed4ee444763fd44080cdc8e4260b9b133d83a207d18ff120f4704adee9356

  
Dropping
MD5 9e904ccdf6ed451c6968e0d0963b6600
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d38ed4ee444763fd44080cdc8e4260b9b133d83a207d18ff120f4704adee9356

Comments