MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8cf706a6a83fc6388cb81c5f090e38dc7aaf0a51cd505b572f7d19e5a555f0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara Comments

SHA256 hash: b8cf706a6a83fc6388cb81c5f090e38dc7aaf0a51cd505b572f7d19e5a555f0d
SHA3-384 hash: c926607c86057fa49b9bdc473da0cda0b03bbfc1e4ee1dfdd5332d7e0a29f27c1108eda361409f5900f743fed968d429
SHA1 hash: fdb4f7ce1e0770faa0641f87c900d3548e0ea3c2
MD5 hash: fc63031f16cbb664af91f879737c8548
humanhash: bulldog-arkansas-failed-nebraska
File name:SCAN0300620.zip
Download: download sample
Signature AgentTesla
File size:383'263 bytes
First seen:2020-06-30 09:04:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:4xuEbkYnfEEwdNrNiH08MFY5UYf+hw2vPS4EBBeaqoSBgmW8aVYDJlmpYyprwyYT:4xuofE5dbS0mUYf+hbC4EBYau2V84MJt
TLSH BD842395A211990174A7447ABB79EC742CEAE5F50CA86DA833024F4FEF5C6FC720D0DA
Reporter @abuse_ch
Tags:AgentTesla zip


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: mejdaf.com
Sending IP: 157.230.255.200
From: export@mejdaf.com
Subject: Commecial invoice and packing list
Attachment: SCAN0300620.zip (contains "SCAN0300620.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 30
Origin country US US
ClamAV SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Sanesecurity.Malware.25455.ZipHeur.UNOFFICIAL
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/b8cf706a6a83fc6388cb81c5f090e38dc7aaf0a51cd505b572f7d19e5a555f0d/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 09:06:08 UTC
AV detection:24 of 48 (50.00%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b8cf706a6a83fc6388cb81c5f090e38dc7aaf0a51cd505b572f7d19e5a555f0d

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments