MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8de7fec81dec67e1e119ebad41c3899da508d5217046d0f2a5070c09a703cc75. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8de7fec81dec67e1e119ebad41c3899da508d5217046d0f2a5070c09a703cc75
SHA3-384 hash: bf58968a2859ec0230752fcc2a478e587364ff81f83a2829690c065fe65b95fa347f4e065276d8ac5899dfec7cb0c0c8
SHA1 hash: eb972823cd11a1fa4cff488460ed44d4a5f4c951
MD5 hash: 3c21e1920d7366bc9a091abdaf52af96
humanhash: comet-cola-fourteen-robert
File name:PAYMENT ADVICE.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:443'465 bytes
First seen:2020-04-24 04:46:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:WeaWxviFQuVz75n9DGo/qP+u+oyEVRNXgOwOBhJK3QcK:3aYq6E9DVWB+o3FwuP/
TLSH 569423F2742A5D5D3AD21B8AE243E0F513C587AA0BA3C6C6DD1E95C1CA12835E1787CF
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email
From: Zhang Hong<zhg@amchkl.com>
Received: from amchkl.com (unknown [185.222.57.226])
Date: 23 Apr 2020 19:08:43 -0700
Subject: payment confirmation advice from our bank
Attachment: PAYMENT ADVICE.zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.47960.4790.2080.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-24 00:24:53 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rxt75sa55rt6dyiz5owudq4jtwsqrvjbobdnb4vfa4gatjydzr2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 8de7fec81dec67e1e119ebad41c3899da508d5217046d0f2a5070c09a703cc75

(this sample)

AgentTesla

Executable exe a86963a2cc10f60fcf875abc6245f32e943042e5947a05d81b312d4f4f4a9b4e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a86963a2cc10f60fcf875abc6245f32e943042e5947a05d81b312d4f4f4a9b4e

Comments