MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c74f8221087f5fbba21635a23562f365659e05311e7d31708b986454d63826ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c74f8221087f5fbba21635a23562f365659e05311e7d31708b986454d63826ba
SHA3-384 hash: 0b58bd294c2f4fbb02b3bf551b140fd53d31989df51cd34eb4770ab7d905dfd35ce8ed15bd9d5409d9aeedaf4345f849
SHA1 hash: b218d3993e8c2259ac85d3926828968ac8c33fb4
MD5 hash: d2bee3d8b7515b6d975c3eae8359eb31
humanhash: red-twelve-victor-fruit
File name:QUOTE 002242020.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:373'197 bytes
First seen:2020-06-29 05:57:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:mL8Ndh55cTZLDwTX7FP6d0Fx//z6QpRxBo8eIacysAPel1yOZEda2uqAwJQZOTlQ:u8pWDC7FidMdxTensweUJJvTG
TLSH D5842383E19D1A76F6D3793CBB4F78144A55B61419529CB012E3BD4A42229FA33F2C87
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: khusheim.com
Sending IP: 103.99.1.149
From: Mubeen Ur Rehman.K.K<proc29@khusheim.com>
Subject: RE: QUOTATION 
Attachment: QUOTE 002242020.zip (contains "QUOTE 002242020.exe")

AgentTesla SMTP exfil server:
mail.parshavayealborz.com:587

AgentTesla SMTP exfil email address:
info@parshavayealborz.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ENGK.190.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c74f8221087f5fbba21635a23562f365659e05311e7d31708b986454d63826ba/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 05:59:03 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y5hyeiiip5p3xiqwgwrdkyxtmvsz4bjrdz6tc4eltbsfjvrye25a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip c74f8221087f5fbba21635a23562f365659e05311e7d31708b986454d63826ba

(this sample)

AgentTesla

Executable exe 617d412ea96ae9c5d0934c714a811b839015e763c2731879dad2cb998336a3fb

  
Dropping
MD5 6123fcaf7bf0ff1a2d3e259efef7a6e9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 617d412ea96ae9c5d0934c714a811b839015e763c2731879dad2cb998336a3fb

Comments