MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f84f36180f2ebb246355b50954519a7e1a98e2e064ce8ede63ef266e9242f396. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f84f36180f2ebb246355b50954519a7e1a98e2e064ce8ede63ef266e9242f396
SHA3-384 hash: 1385477ddf574cfe30b48be64f61f67275971d56df4e7bbb619cfc00ed8cb3f9028f1699fb6398f3d7a7c56e012f015e
SHA1 hash: d57953e97f550383c69d08d0a34e15e96e8e6647
MD5 hash: 1829d2e13932e9f754b25a005d7ef6f5
humanhash: coffee-johnny-lion-kilo
File name:Payment TT.ace
Download: download sample
Signature AgentTesla
Create hunting rule
File size:536'313 bytes
First seen:2020-09-02 06:20:29 UTC
Last seen:Never
File type: ace
MIME type:application/x-rar
ssdeep 12288:zkxUdladzmc4ynSoOdGM+DP1FusVIOiqRu6nCxVDWSi6ah0rF:zkViTm/OIM+D6sqejKF
TLSH 9EB433CE4007C7DD6AFAD13A06C815667D2C9085EFFEA327AB58B60614663BBC14C6C7
Reporter abuse_ch
Tags:ace AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps03.bsolus.pt
Sending IP: 80.172.253.75
From: Alex Tan Ticaret Ltd. Sti. <info@ekaservice.ru>
Subject: Re: Payment swift TT copy
Attachment: Payment TT.ace (contains "bNjdGneVfRkYyV6.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f84f36180f2ebb246355b50954519a7e1a98e2e064ce8ede63ef266e9242f396/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-09-02 05:58:46 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7bhtmgapf25siy2vwuevium2pynjryxamthi5xtd54tg5esc6ola._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f84f36180f2ebb246355b50954519a7e1a98e2e064ce8ede63ef266e9242f396

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

ace f84f36180f2ebb246355b50954519a7e1a98e2e064ce8ede63ef266e9242f396

(this sample)

AgentTesla

Executable exe d6f0c8635b3633a57516f738ace0b4feb392894885b604d426b950c0c95d705d

  
Dropping
MD5 bdc03e1649f005b65146756fdf737f3e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d6f0c8635b3633a57516f738ace0b4feb392894885b604d426b950c0c95d705d

Comments