MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30ddff238f3725782d7794c8a62bd7fd2c7c1ec58d2283858807d2a5042cf347. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30ddff238f3725782d7794c8a62bd7fd2c7c1ec58d2283858807d2a5042cf347
SHA3-384 hash: 8568c353eb266fafbc2a7a89bf960829572e38bba97298bb1f184aae9844112350b45a5a2e4f6c0cf6baa577f77996c6
SHA1 hash: 2e3506619c23cd8e3859fd9357f9c37991769fe2
MD5 hash: 5d18207b79119126c746dc48f4db0960
humanhash: steak-october-carpet-indigo
File name:payment. 4029530.iso.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'032'584 bytes
First seen:2020-05-22 10:08:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:WlKImBUa9FTveb3jkvW2vqOmCz5yf7S486s88sz4:WlKlDeb3YvZyPCyOLj88y4
TLSH 8225333650615EF6F22FF75E4458233F093FA023FE8691952A6F1AB6DB016C02D4CA79
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: solid-me.com
Sending IP: 103.99.1.148
From: Ayman Al Kottob<ayman@solid-me.com>
Subject: RE:Order Prepayment _ BankCopy
Attachment: payment. 4029530.iso.zip (contains "payment. 4029530.iso.exe")

AgentTesla SMTP exfil server:
mail.pptoursperu.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 09:58:44 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 30ddff238f3725782d7794c8a62bd7fd2c7c1ec58d2283858807d2a5042cf347

(this sample)

AgentTesla

Executable exe ff8d6da1265736b8a06bcc8a9837bc151e00385c45355807a75e492eeea01219

  
Dropping
MD5 10513a2ba02b68839a2611cd8e5e021f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ff8d6da1265736b8a06bcc8a9837bc151e00385c45355807a75e492eeea01219

Comments