MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed2c34c719cbb69644d74f2fa7c9886fe64846afd263ec2fae7e4409067baac5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed2c34c719cbb69644d74f2fa7c9886fe64846afd263ec2fae7e4409067baac5
SHA3-384 hash: 37a9832c95d65a509522659d3f5a82270ec28c7a18e50d7da87e2b9916b50f46ec9814d481a9cd8eed51a86d32b26a78
SHA1 hash: a0166334d2022fb6ad85fcdb8a6713d5958013ec
MD5 hash: b1a1fe23e818d3da8415cb118fba9a31
humanhash: saturn-lion-double-mobile
File name:IMG10120207010.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:765'957 bytes
First seen:2020-07-22 08:39:40 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 12288:U0qHh74rZMzeOmJSwseSQ3jlKCHTKpHy+7UKpeciPW9E/N7bY+kGQJRr2NtT+kLJ:u74rZ0eqpeJlNH+pHyTKS6SY+XQJRCLb
TLSH A6F42392BD8BD8E65A95283D10E0FF37770B2E1B21FBA6051318961491772EA34CB3F5
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: fococonsultores.net
Sending IP: 82.223.29.21
From: Shaikh Jaffar Ali <sales@mf-industry.com.ae>
Reply-To: sales@mf-industry.com.ae
Subject: Quotations
Attachment: IMG10120207010.7z (contains "IMG10120207011.bat")

AgentTesla SMTP exfil server:
mail.imacdeveracruz.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed2c34c719cbb69644d74f2fa7c9886fe64846afd263ec2fae7e4409067baac5/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 04:48:13 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5uwdjryzzo3jmrgxj4x2psmin7teqrvp2jr6yl5opzcasbt3vlcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ed2c34c719cbb69644d74f2fa7c9886fe64846afd263ec2fae7e4409067baac5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z ed2c34c719cbb69644d74f2fa7c9886fe64846afd263ec2fae7e4409067baac5

(this sample)

AgentTesla

Executable exe 052bcc60e46315357188930ba35adce006f4e223a50c862db9795998d96faa30

  
Dropping
MD5 085d29006ec989b5938ddc78f78c72e9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 052bcc60e46315357188930ba35adce006f4e223a50c862db9795998d96faa30

Comments