MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33bf0ecbb5d80a8866fba59289b7a15b69e80f87589635e45f1ddc5da46dfcf8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara Comments

SHA256 hash: 33bf0ecbb5d80a8866fba59289b7a15b69e80f87589635e45f1ddc5da46dfcf8
SHA3-384 hash: 4fc30cf030f87a3a85fbab1157eed91a81f4069edde4c7802274c6cf3936015f429edcca56b34f4494947919ae774858
SHA1 hash: 74b60b33fdb1278b7718901153a1173d5a78dabe
MD5 hash: 15f5b07f42c4fed0df078083f36607ab
humanhash: oranges-jupiter-black-autumn
File name:payment.img
Download: download sample
Signature AgentTesla
File size:1'245'184 bytes
First seen:2020-06-30 05:19:11 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:lAdwd5wWYfnjF3tvWbNwijE32xi7lXJtXgs5f:lrdpenjF3sNjjEGUBXN5
TLSH 7A45F128361D793BC9B81CF980D2650413B5A4723963F7E96ECC61D813EABED0741A7B
Reporter @abuse_ch
Tags:AgentTesla img


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: secure.zrl.com.zm
Sending IP: 216.194.164.118
From: bubaya.malambo@zrl.com.zm
Subject: Fwd- Payment ....
Attachment: payment.img (contains "payment.exe")

AgentTesla SMTP exfil server:
mail.blueink.co.tz:587

AgentTesla SMTP exfil email address:
greatestdad727@gmail.com

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 26
Origin country FR FR
ClamAV SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/33bf0ecbb5d80a8866fba59289b7a15b69e80f87589635e45f1ddc5da46dfcf8/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Npe
First seen:2020-06-29 20:30:53 UTC
AV detection:18 of 31 (58.06%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:Virustotal results 8.20%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 33bf0ecbb5d80a8866fba59289b7a15b69e80f87589635e45f1ddc5da46dfcf8

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments