MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1db16d6c17a28ea34f89546b485e210d8e77bc40c2ce14b8bdd6610506e0bc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1db16d6c17a28ea34f89546b485e210d8e77bc40c2ce14b8bdd6610506e0bc2
SHA3-384 hash: f33bf28c4628043ce7cbab262836c18b3a2eaa0252c82a9e13755e468b7ac35167e8d3ee41b56c1a47f4dbeec8132330
SHA1 hash: b5ca9c9ed60525bba03b58ab1413a4fce51292dd
MD5 hash: 8874f397ba40abab245aac7387b9de9d
humanhash: moon-tennis-artist-sweet
File name:Proforma invoice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'139 bytes
First seen:2020-06-02 09:21:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Hyp2ZRYNwwjU1FA0odqrRaemNGLGZFrbW1/hCOZ7KyomSENoYrGQ4y+uo7ySNqc:RXFAZKzmdr+77PofHvQ4y+DWq
TLSH 6E84234C62A3B5CD5E8DF529B63266660708E38F28574C87BB5CC005D1A6178FED23FA
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx.tituae.com
Sending IP: 195.231.83.90
From: Dattaprasad Mohite<user@tituae.com>
Subject: Re:Proforma invoice /Bank Details
Attachment: Proforma invoice.zip (contains "Proforma invoice.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 04:02:36 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6hnrnvwbpiuounhysvdljbpccdmoo66ebqwocs4l3vtbaudobpba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f1db16d6c17a28ea34f89546b485e210d8e77bc40c2ce14b8bdd6610506e0bc2

(this sample)

AgentTesla

Executable exe ca61f3fba5e6d86553e1ffe61a2ce58836065b09f6959ff3cf4e778b6ca12436

  
Dropping
MD5 c89308fa5fe96fba14b9b6e3ca4c6492
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ca61f3fba5e6d86553e1ffe61a2ce58836065b09f6959ff3cf4e778b6ca12436

Comments