MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0ddc31e31ebccb7f057820e25378cc205c42ade06eef7210acee88030a8aa38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0ddc31e31ebccb7f057820e25378cc205c42ade06eef7210acee88030a8aa38
SHA3-384 hash: 9d36a158dba844e7b498905e51133bd4d0be323973265d37871306712f05238d0ac974a190d455d84fe8642c84f1a60c
SHA1 hash: 6007c6e9a34b217660be47cc004241afa32f2a00
MD5 hash: 82f2397edb54f947f83d0e332c5fba3f
humanhash: failed-lemon-asparagus-oranges
File name:Payment Confirmation.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:423'014 bytes
First seen:2020-05-12 09:24:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:vnLOhj6N1ZP7LsRyJxh+NszMiMjSTnOfDD27P2K9ihPNpIA8BeMURLr/IzNRl3Eb:vnL/ZP7Ls+qhixWeiHhjIA8d/ZRo
TLSH D7942333BC4F4AAC2A4E17DAFDBA534C2392520BA6751CB83F286D51178BE6D305453B
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sw26.saharanet.com
Sending IP: 212.76.85.87
From: Martin Eeltink <sales@rakco.com.sa>
Subject: RE: Payment
Attachment: Payment Confirmation.zip (contains "Payment Confirmation.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22041.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 09:36:54 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
30 of 48 (62.50%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4do4ghrr5pglp4cxqihckn4myic4ikw6a3xpoiikz3uiamfivi4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e0ddc31e31ebccb7f057820e25378cc205c42ade06eef7210acee88030a8aa38

(this sample)

AgentTesla

Executable exe 04f52aeb0c5923b55f2576643009018b6ac3c7fd3569340312f3bc3fd1eb1120

  
Dropping
MD5 87746c3025837b2421907dd4d0d97cff
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 04f52aeb0c5923b55f2576643009018b6ac3c7fd3569340312f3bc3fd1eb1120

Comments