MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2118a50496820800cfc70a5ea71bc7b31904380ad10fa3ffda1e0296b8ea5cc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2118a50496820800cfc70a5ea71bc7b31904380ad10fa3ffda1e0296b8ea5cc4
SHA3-384 hash: 3f86c4a721e3ee118f201b3b58ce2919e8b600f3952f8b73689ee39e3f1b1ef30120bcf4019ea3e4fd8b40ccdf5fd659
SHA1 hash: 5e6d723d8584832a5b49ba68924af384b3f16485
MD5 hash: dde44b59842817b673c7bde28db8a5a9
humanhash: mars-mountain-pasta-nevada
File name:new order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'884 bytes
First seen:2020-06-15 14:16:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:QmHxCC81GWFLByQvyOP+gzSA6pTmT6DTVsC1APuSqOIRbWZURPQWEBN2d:L8nbZN6A6DNWq5RqZUR4NN2d
TLSH D4942327E0AB461576062174A46D5BB3E4A3BE43803FE22BFE04549D41CF249532AFDB
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: Werner Götz <premer@cyber.net.pk>
Subject: Urgent request new order//Quotation List
Attachment: new order.zip (contains "new order.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21190.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 12:34:34 UTC
AV detection:
32 of 47 (68.09%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eemkkbewqieabt6hbjpkog6hwmmqioak2eh2h762dybjnohkltca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2118a50496820800cfc70a5ea71bc7b31904380ad10fa3ffda1e0296b8ea5cc4

(this sample)

AgentTesla

Executable exe ec35d01b2a195c348b20565d96de7d5dc6385dd23e7452b55ee4200cca7490fa

  
Dropping
MD5 40af518941f73ee0867e18c6f44fd742
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ec35d01b2a195c348b20565d96de7d5dc6385dd23e7452b55ee4200cca7490fa

Comments