MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0c806b1a840b5faa3faf4f83dc38ff1769a7a8b0dc340e65014296a73cd0597. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0c806b1a840b5faa3faf4f83dc38ff1769a7a8b0dc340e65014296a73cd0597
SHA3-384 hash: f147131d0d27debde44d09fce2e3055b2c300a571509c51e063f0295b419ac74fdf2a6e840c1b216c23f1aec08899c52
SHA1 hash: 4fed6df09fed092e4ae1f2812f5cfbf303b3b3ca
MD5 hash: 3dd0a3c72d67469053e113e6e0ad60b6
humanhash: east-stream-lake-comet
File name:Remittance copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:262'650 bytes
First seen:2020-07-07 12:44:55 UTC
Last seen:2020-07-07 16:54:45 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:XRVXpNTarxLEtnZ4kw28GQs8+M8I4dgxvjWu2acA2H2zuR:BnNTarQD58+jNgxyu28LyR
TLSH 204413AF5CAE219CAD8F2CF949273202B3DA70A5C78714FDB5D201D40FB4AD19525F8A
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: appareletc.net
Sending IP: 209.58.144.239
From: sales@appareletc.net
Subject: FW: SOA Review Done : Inter Bank Transfer(IBG) URGENT
Attachment: Remittance copy.zip (contains "Bank Swift.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e0c806b1a840b5faa3faf4f83dc38ff1769a7a8b0dc340e65014296a73cd0597/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 12:46:13 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4deanmniic27vi726t4d3q4p6f3ju6ulbxbubzsqcquwu46nawlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e0c806b1a840b5faa3faf4f83dc38ff1769a7a8b0dc340e65014296a73cd0597

(this sample)

AgentTesla

Executable exe 680cb634fa1fcc47a2760a86939423413d46aeb170b703732db614c2e96260d1

  
Dropping
MD5 f55aff3fd76077b94b58fd946b837a3b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 680cb634fa1fcc47a2760a86939423413d46aeb170b703732db614c2e96260d1

Comments