MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce0dea969f425255b8d83bb730aad6fa2348fadc7d56338772793e9ff74f3020. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce0dea969f425255b8d83bb730aad6fa2348fadc7d56338772793e9ff74f3020
SHA3-384 hash: 47338c03d8bf814aff2e12a9aae9ede9b404ab3be0bdba086389ba1199eb4ea97697b5263c32df8b996af23d6b9fd314
SHA1 hash: c25481934e0be3183899f00608acb1dba8a65be8
MD5 hash: 10be33d08f597288f7cc3f6896fec457
humanhash: ink-harry-spring-alanine
File name:PO101166.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:364'283 bytes
First seen:2020-05-13 07:18:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:blSJzrGN/qGEs7IdCGDHiZbWiJb9VufG1pdumQFaEIdLUr4Gr1/gKWij:pSJ+/PDEwGG9J5kfOLyQRdi4Grlgd6
TLSH 3874239BE3C0E03CDA43FB1DF0905DBA051B9F309221DAADA69B5A53441AD6DDDBC10E
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.biokorntackt.com
Sending IP: 45.95.168.106
From: Nikos Lathourakis <info@biokorntackt.com>
Subject: mixd ctnr
Attachment: PO101166.zip (contains "Ziegler Hellas SA GROUP 1X40 CNT #PO101166 .exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 07:37:04 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
14 of 48 (29.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zyg6vfu7ijjflogyho3tbkww7irur6w4pvldhb3spe7j752pgaqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ce0dea969f425255b8d83bb730aad6fa2348fadc7d56338772793e9ff74f3020

(this sample)

AgentTesla

Executable exe 3c6ade352dcf983887305516d4badfef0c2ba06e20f90cf34f09c4cf928196b5

  
Dropping
MD5 1d03e0012f36abbd2453692cdd0b1e02
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3c6ade352dcf983887305516d4badfef0c2ba06e20f90cf34f09c4cf928196b5

Comments