MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ee0af05bc4d906114e9fd6280c6c727c4244519b48f724c739e9ec18c2a5d33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ee0af05bc4d906114e9fd6280c6c727c4244519b48f724c739e9ec18c2a5d33
SHA3-384 hash: 0e2a69cdac0b931cf98a41ef17e832d658e48aac105f9ca2a416a556b947f0d9bb3e0d4605fa9f951e04114ecde5f418
SHA1 hash: d54d96fbb1ebcde5ea552a6f8734f319ded6196d
MD5 hash: 12fdce7a5c0202558f7a0d3e1d6a0d03
humanhash: indigo-shade-river-lion
File name:correct CI and PL.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:399'086 bytes
First seen:2020-05-24 09:05:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:dq5jLveYVFGqsJRJoR5rCVmmLVmkMLVU1FoFWzwXO4SjZhwMa2LxWtIyU3r+0x:kJz4ef2V/dMLaoFWyKjbLgtgr+U
TLSH 2784236724F985E1329A806FA58209CBC927113B454CA8CD375A72728F733DDC98D7AF
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: 23.226.135.108.static.quadranet.com
Sending IP: 23.226.135.108
From: Sara<master@xinlin.com>
Reply-To: bur.staten@bk.ru
Subject: correct CI and PL
Attachment: correct CI and PL.zip (contains "correct CI and PL.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.ELBN.7542.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-24 09:35:31 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
25 of 46 (54.35%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2ee0af05bc4d906114e9fd6280c6c727c4244519b48f724c739e9ec18c2a5d33

(this sample)

AgentTesla

Executable exe 3916223f31696e8194a7879db01acb532d1a22bf03f0bfa3f9e3f06aa4d7768f

  
Dropping
MD5 697944d4c8582f2d62dbcc1dce5d1308
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3916223f31696e8194a7879db01acb532d1a22bf03f0bfa3f9e3f06aa4d7768f

Comments