MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d45e0eaf66371f271ec073be23090fbdde7cd303e4fe94ab136fb85278b2febb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d45e0eaf66371f271ec073be23090fbdde7cd303e4fe94ab136fb85278b2febb
SHA3-384 hash: d31cac68fb46454cabf2871c0df6e195d8f7b3c80363804b4e70e20c2ddac10af347013a8a5dd92a07fa3fe6cfc2507e
SHA1 hash: 9ad9c2248b285427b3f3dcbef63e70f1a7dd9af8
MD5 hash: e61ec466408f65570f00d3c0070e2767
humanhash: fanta-minnesota-grey-bluebird
File name:New Order.pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:431'774 bytes
First seen:2020-05-14 08:15:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:qJXV+YqyzV0BY/5/rzjh+iMqHY1bToRjiLG366KNVQ8tMjz:qBcKzV0i/rzHebTosLG363tkz
TLSH 7B9423331A07DA09A7E00A7625C1B347C8F804EBE7C677096562A995DE93E7D038D1FB
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: eradicateplastic.com
Sending IP: 185.222.57.165
From: Magdi Amin <info@eradicateplastic.com>
Subject: re: re: re: New Order
Attachment: New Order.pdf.zip (contains "New Order.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.20634.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22623.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 08:36:17 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2rpa5l3gg4psohwaoo7cgcipxxphzuyd4t7jjkytn64fe6fs725q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d45e0eaf66371f271ec073be23090fbdde7cd303e4fe94ab136fb85278b2febb

(this sample)

AgentTesla

Executable exe f33188a4e793d7f27b2c649730162700bda0259988ee59262ca2be5a87527f83

  
Dropping
MD5 ad2d528544375f3504eee35d3d10bdfc
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f33188a4e793d7f27b2c649730162700bda0259988ee59262ca2be5a87527f83

Comments