MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c2ab744c77ead1b4ea974a59ae32072b276e305cab039181903d0ea140b6df5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c2ab744c77ead1b4ea974a59ae32072b276e305cab039181903d0ea140b6df5
SHA3-384 hash: 79d6c2ff81643fe9f04db2526023312d8633e71e21cdaf98475a307d2d6999bc1fb91de0b888e627b8c13e1881b93645
SHA1 hash: 1a53e144ff7ec5324e3d5e9ec591ba2c1bb9d37e
MD5 hash: c7f78532bf2843d81f414776b05af422
humanhash: robert-butter-lima-oregon
File name:74725794.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:6'035'967 bytes
First seen:2021-01-19 07:26:15 UTC
Last seen:2021-01-19 07:52:09 UTC
File type: zip
MIME type:application/zip
ssdeep 98304:G+j2NdQGtKzzsPXuNXF7N2d96jDvk/x9z9Wm3VeEY25iCBP5rtMEI:GnbjI/CmA9EDc/Dz92wi65Wh
TLSH 1756338E51EEA33300C38A48F44A36B2FB3D3C216B7656507AB99B73AAE44D65357701
Reporter abuse_ch
Tags:CHN DHL geo zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: services-feed.sapphireflat.com
Sending IP: 144.208.127.207
From: China DHL Express <5idhl_noreply@dhl.com>
Subject: 【中外运-敦豪】电子发票(发票号:74725794)
Attachment: 74725794.zip (contains "74725794.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_exenum416.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c2ab744c77ead1b4ea974a59ae32072b276e305cab039181903d0ea140b6df5/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-19 07:27:11 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nqvlorghp2wrwtvjosszvyzaokzhnyyfzkydsgazapioufalnx2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6c2ab744c77ead1b4ea974a59ae32072b276e305cab039181903d0ea140b6df5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 6c2ab744c77ead1b4ea974a59ae32072b276e305cab039181903d0ea140b6df5

(this sample)

AgentTesla

Executable exe 8b6da6511860d9a2c86b0ea5f1f31a7811d654a4cf638c9e98fcd806c59050a8

  
Dropping
MD5 1c20af221e8698d42f1c4059805c5a63
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8b6da6511860d9a2c86b0ea5f1f31a7811d654a4cf638c9e98fcd806c59050a8

Comments