MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb88bee15ca62afd52e1b6dcb6c4b7a02f36472aeef61efe63b6d1d804ff6007. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb88bee15ca62afd52e1b6dcb6c4b7a02f36472aeef61efe63b6d1d804ff6007
SHA3-384 hash: b940407447a59105e451dec1deb6b7bfb336fafaf7d2945f8e14e97fb1b77f6d50145898d4430f85343dd6d01168473c
SHA1 hash: 1a49bf59c024c4c7112babc5213a48dcaffe1713
MD5 hash: c19cc003d2ed96f2570061e23558011d
humanhash: alabama-romeo-mirror-equal
File name:payment slip.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:553'561 bytes
First seen:2020-10-20 06:26:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:IG1X87+pmuchmg+asnGt0bMgivDBrHw4SxAiuKpnvucF2G:hmmRcynXbD0DhH9KnvuckG
TLSH 04C423345BB2E0894E7815FCF5D6166B1C800915F732A7CAD8B6A67C2FB0D9303ECA94
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cpshared11.tedata.net
Sending IP: 213.158.187.42
From: Nejat <nejat@ewfcpl.com>
Subject: NEW PAYMENT RECEIVED..
Attachment: payment slip.zip (contains "payment slip.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Siggen9.56514.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21664.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb88bee15ca62afd52e1b6dcb6c4b7a02f36472aeef61efe63b6d1d804ff6007/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 18:30:56 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7oel5yk4uyvp2uxbw3olnrfxuaxtmrzk533b57tdw3i5qbh7madq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fb88bee15ca62afd52e1b6dcb6c4b7a02f36472aeef61efe63b6d1d804ff6007

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip fb88bee15ca62afd52e1b6dcb6c4b7a02f36472aeef61efe63b6d1d804ff6007

(this sample)

AgentTesla

Executable exe 6218038bf6ea86f19129bdc673cdc1ab6f58b27b1a61a8438aaacbcf7eea0e29

  
Dropping
MD5 b917f5efe055c07a7b37fa717b1fd705
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6218038bf6ea86f19129bdc673cdc1ab6f58b27b1a61a8438aaacbcf7eea0e29

Comments