MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c62ef7f1785f3ea376717feb4a51fca455906167077be59872482bccef736063. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c62ef7f1785f3ea376717feb4a51fca455906167077be59872482bccef736063
SHA3-384 hash: 5d09fc6ce67fd0e4d26d4d7497bb7a3ea70f2797b2b56560d8c8768c1cd577e9107f6b23a99f48e2905cd86b0b4fc1c2
SHA1 hash: 02c3d18852155c987d358ebb8ee711f3382b04a2
MD5 hash: a86f2053bf1cb6e0e9c5ce81ae4a6e3d
humanhash: glucose-spaghetti-seven-fanta
File name:9003999388303.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:396'022 bytes
First seen:2020-05-25 18:03:36 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:esEm+o3YrBLMNqhVagdxOTsgeSDSJAOCIednFpq5XK7S5vEHDX5Sev:esEm+o8VjjwTsgelyOiq5X0BjX53v
TLSH 0384237E88DB06339B085207F565B73E03D5282FD1CB5540E6BF2A3BE85A315E1C749A
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: kalelis.gr
Sending IP: 185.126.202.96
From: PT. COSCO SHIPPING LINES INDONESIA <info@kalelis.gr>
Subject: Shipping Document (CI & PL)
Attachment: 9003999388303.rar (contains "#9003999388303.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 18:35:38 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar c62ef7f1785f3ea376717feb4a51fca455906167077be59872482bccef736063

(this sample)

AgentTesla

Executable exe b1fd1e541922f806d521a8a0925822f85060919230b70c7dfdf6eb7c36b02502

  
Dropping
MD5 9440d1fcd06be3c366f7c9e537878ad1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b1fd1e541922f806d521a8a0925822f85060919230b70c7dfdf6eb7c36b02502

Comments