MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f106e0eda766deb60ebef155d54cae94ab771b1405100fbf4633b09c0be80210. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f106e0eda766deb60ebef155d54cae94ab771b1405100fbf4633b09c0be80210
SHA3-384 hash: 2ddf59d15585b0862e8c2a13572bfd7535db60a7dd8c451e7dd575e2b14915d3e55072efb8c393c1406591320ef5b18d
SHA1 hash: 58ce950a15b987e060f0da58055b6536555baf24
MD5 hash: cbbc41208147870075f9051b9d9f60d8
humanhash: georgia-quiet-lamp-oscar
File name:invoice is still unpaid.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:385'281 bytes
First seen:2020-05-16 12:04:59 UTC
Last seen:2020-05-17 06:32:57 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:otRVkqrfahGeQ8VoAYROWkXTaTRYxj1ETwmyQd+coY4r1qA7SOGbYf1k:gTz+GeQ8VeRbaTgYxjuMQMcYMYf1k
TLSH 3C84231D6CBD818499832CFA00D1FD0BCD7DAD8D7DB03B5926129160ABEBE7517C4E89
Reporter jarumlus
Tags:AgentTesla

Intelligence

File Origin
# of uploads :
3
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23942.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24066.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23810.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-16 08:44:41 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6edob3nhm3plmdv66fk5ktfossvxogyuauia7p2ggoyjyc7iaiia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f106e0eda766deb60ebef155d54cae94ab771b1405100fbf4633b09c0be80210

(this sample)

AgentTesla

Executable exe e2a0f5b80f047e2610b7c42b3af3d2da4e049c63c9e35c3d9c317aecbee6f9e5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e2a0f5b80f047e2610b7c42b3af3d2da4e049c63c9e35c3d9c317aecbee6f9e5
  
Dropping
MD5 acd006bec2123210f523c91d0009ae4a

Comments