MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 570d4ac0ca764601b37e77aea4b5bf8138bdbaa24f46255fa68b09d4dc62869c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 570d4ac0ca764601b37e77aea4b5bf8138bdbaa24f46255fa68b09d4dc62869c
SHA3-384 hash: c996098a2a99b1b0aa28a7642f57bed2dbb7626b9679231e2a1d8f3f03c544e72a97590d381f4af8f7e33b0b9ae0230c
SHA1 hash: acb23f5c01a3663068090bd96c2045088d2b680e
MD5 hash: 9ee8d82627de869ed99650c6946ff0c5
humanhash: comet-eight-video-glucose
File name:hvala na predra unu.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'647'761 bytes
First seen:2020-05-22 09:28:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 49152:QgF5buH96j1saGaCaW1UCdBw56okgDYQ7O:JF5aHy0aW1RdBMGj
TLSH 3F75330EE5867A5AD07DDF33202D9F8425E0492EF2D078E53995F8371F98687EC1E428
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: cink.avalon.hr
Sending IP: 185.58.73.21
From: majanovic@ptt.rs
Subject: Ri: Ri Hvala
Attachment: hvala na predra unu.zip (contains "hvala na predra unu.exe")

AgentTesla SMTP exfil server:
mail.kapackserv.com:26

AgentTesla SMTP exfil email address:
uzorchukwu@kapackserv.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Ramnit-1849
Create hunting rule

Win.Trojan.Ramnit-1847
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Stealer.19347.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Virus.Ramnit
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 09:36:03 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
38 of 48 (79.17%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 570d4ac0ca764601b37e77aea4b5bf8138bdbaa24f46255fa68b09d4dc62869c

(this sample)

AgentTesla

Executable exe b08f164f0363528f8928f01133da533a2868e12b95177df09b2f11e78510e02d

  
Dropping
MD5 1d025c80f31210ed9530941eae6633da
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b08f164f0363528f8928f01133da533a2868e12b95177df09b2f11e78510e02d

Comments