MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2feeb52cfdce6ef164006f224c520a93e800ed124b9e4bb57f0257153f0639d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2feeb52cfdce6ef164006f224c520a93e800ed124b9e4bb57f0257153f0639d
SHA3-384 hash: da873ebf12b94afaa31be819497e003a7b24500818f76e75217d90d2355f10bbba235a763a8f130b9f51709497c9fe1d
SHA1 hash: cb08c89a9c1926ee3c7fef1892dc035cd557826e
MD5 hash: 8d7a8a13d51b053d6e0255b75ceef9d1
humanhash: november-skylark-oklahoma-pennsylvania
File name:Payment Copy.arj
Download: download sample
Signature AgentTesla
Create hunting rule
File size:417'983 bytes
First seen:2020-06-17 05:50:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:X62jUR4jET42+WmxkzY/88G+DiaViUjYO:X9ev4MmxwW88G+DiaQiYO
TLSH 169423DF48663989A164A9F56CDB7E13D91FA52C640BFBC28BDE24530E3C7A4C631B10
Reporter abuse_ch
Tags:AgentTesla arj HSBC


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sc.com
Sending IP: 95.211.208.50
From: HSBC Global Payments and Cash Management <fbaraza@sc.com>
Subject: FW: Global Payments and Cash Management HSBC
Attachment: Payment Copy.arj (contains "Payment Copy.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.gc.5761.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21237.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 05:52:06 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yl7owuwp3tto6fsaa3zcjrjave7iadwres46jo2x6asxcu7qmooq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c2feeb52cfdce6ef164006f224c520a93e800ed124b9e4bb57f0257153f0639d

(this sample)

AgentTesla

Executable exe 494f9dd6446590e875fa54a866cfc76c795f19722f2842d14d82590de96b6b68

  
Dropping
MD5 2442896682f24bfd0ea5f237d45c95eb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 494f9dd6446590e875fa54a866cfc76c795f19722f2842d14d82590de96b6b68

Comments