MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aeca515b2b5ad615d49b0c0c057f41f0af190bb21fd77d92b126ad0ac05aad52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aeca515b2b5ad615d49b0c0c057f41f0af190bb21fd77d92b126ad0ac05aad52
SHA3-384 hash: a1e9801117e055de12581f411407ec09cb2a9d1f2338a4b8fcfd240d0dd2f85eeb858608d0fde6cafe3e96af96d7d611
SHA1 hash: 35013403bfb64f84680234de936b15bc9ea991f7
MD5 hash: 6b37723b3e1f42884346e486186c3b70
humanhash: tennis-mars-cola-golf
File name:NEW ORDER 2020.xz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:494'374 bytes
First seen:2020-07-30 07:30:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:5gOGEvC+ih4cg71Rfqe+KLsPsK/I47v4o9E3NuZ:iVElMgHqZWuQ4zJawZ
TLSH 85B423394BA35B36AC46A5795614B219CC3A37C71D28C0C93BCB946ABE257124CFEF03
Reporter abuse_ch
Tags:AgentTesla xz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: samundabd.com
Sending IP: 37.49.224.50
From: nazim <nazim@samundabd.com>
Subject: RE: New Order Package 174888 - 1710
Attachment: NEW ORDER 2020.xz (contains "NEW ORDER 2020.exe")

AgentTesla SMTP exfil server:
smtp.bnb-spa.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BScope.Trojan.Delpem.12306.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aeca515b2b5ad615d49b0c0c057f41f0af190bb21fd77d92b126ad0ac05aad52/
Threat name:
Win32.Trojan.DataStealer
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 04:36:33 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v3ffcwzllllblve3bqgak72b6cxrsc5sd7lx3evre2wqvqc2vvja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aeca515b2b5ad615d49b0c0c057f41f0af190bb21fd77d92b126ad0ac05aad52

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip aeca515b2b5ad615d49b0c0c057f41f0af190bb21fd77d92b126ad0ac05aad52

(this sample)

AgentTesla

Executable exe 1f1d87aaf919fc57a2e4498d3d54c8f9c724026b97b05747e1e6bdcccb51be46

  
Dropping
MD5 48fb67150c7a3419c215f10c3e3d1304
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1f1d87aaf919fc57a2e4498d3d54c8f9c724026b97b05747e1e6bdcccb51be46

Comments