MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84f06cedd977f12488a2984757fb5893da697708d33ad837ddece57e1692948b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84f06cedd977f12488a2984757fb5893da697708d33ad837ddece57e1692948b
SHA3-384 hash: 8b842efeca29e6240c2ef93324a26690b029c7d9e1ed6a2480e5901b31e1c6e1946437da98b9c88831badfe07f8eb2c4
SHA1 hash: 84d2e33e7e48cbd6ca741ab678507f2e5e807268
MD5 hash: 06e6fcb9fdb88485930b82761be91c87
humanhash: missouri-montana-skylark-delaware
File name:QUOTE 2020.pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:409'702 bytes
First seen:2020-05-25 12:39:15 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:upgH5vHR6LPqRjguYbB7plZK0nBVwTVLFaCaIOY2Z/SPvbPeoNju85+tq0HkXBpj:up05vtj1y7nZJVw5L8YZI/S7LPX0qh
TLSH 3E942361426A753CB5620290AD4E797D3C81E4C7E50ECBA848F1EB7EAD16CDA32DD3C1
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bartz-maschinenbau.de
Sending IP: 156.96.47.65
From: Lisa Reitschuster <sales@bartz-maschinenbau.de>
Subject: *URGENT SUPPLY* QUOTE 2020
Attachment: QUOTE 2020.pdf.gz (contains "QUOTE 2020.pdf.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 13:36:57 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz 84f06cedd977f12488a2984757fb5893da697708d33ad837ddece57e1692948b

(this sample)

AgentTesla

Executable exe 35d7bfaf15b4c37dd98a3906fa758f760208f1d61424a29aaf9db44d43d87979

  
Dropping
MD5 691d381818d7d6e2fffa5abb2f24337f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 35d7bfaf15b4c37dd98a3906fa758f760208f1d61424a29aaf9db44d43d87979

Comments