MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b13d3dc6afd5f3b4104329e6ba14c81cbb147c6cd2601b891923187d02613d7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b13d3dc6afd5f3b4104329e6ba14c81cbb147c6cd2601b891923187d02613d7c
SHA3-384 hash: cb27d4e4cbd1215b7048d1b7bd5aa9f1fd5ba61156c4cd23870283e9c74a56889d08ec6cf384743cd4c8a0a0c3a7df89
SHA1 hash: b056d68181cb92d286da6deee616293c036df355
MD5 hash: 57254f71de1cb92135bf7459222a08af
humanhash: florida-undress-november-louisiana
File name:Scan005.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:353'122 bytes
First seen:2020-06-18 06:53:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:7nkdSHPHTVDILo5lFDZW7L6KhL60ekPwuV4MagOTsJDcS5pke8xZC39JYz:7kUvHxDIkvVZ+L9L60ebuV48XcS5pklD
TLSH 1B742380186487AEB18070AF0C54794A6FC8647B1FD37E11436CBB3BD68E3B296DE597
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: srv189.svservers.com
Sending IP: 46.17.41.31
From: Walid Ahmed <info@deltainternational.ga>
Subject: Re: Inquiry - ASAP
Attachment: Scan005.zip (contains "Scan005.exe")

AgentTesla FTP exfil server:
ftp.lysandruolaw.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24839.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 06:55:05 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=we6t3rvp2xz3iecdfhtlufgids5ri7dm2jqbxcizemmh2atbhv6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b13d3dc6afd5f3b4104329e6ba14c81cbb147c6cd2601b891923187d02613d7c

(this sample)

AgentTesla

Executable exe ef6cbe8e4762412374dd74dbb36bd2728f9a627212f14ad2890159945c0a5fb3

  
Dropping
MD5 b8057a8d132d3912aae35d9c613016d2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ef6cbe8e4762412374dd74dbb36bd2728f9a627212f14ad2890159945c0a5fb3

Comments