MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0122db3df94265efafc48b62e961eadd01998a7ec8cb78a174064845cd08e1eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0122db3df94265efafc48b62e961eadd01998a7ec8cb78a174064845cd08e1eb
SHA3-384 hash: f74296d44ce1b2dc6fc9164e7b9cccb279c589f4ad851837fcf2b1e3cd28c71fd2f9df99fec85c77283a9b08cf4fcb59
SHA1 hash: 53cf4bd7aa06a4d90640bca0070eb5ea03f0f722
MD5 hash: e4df2e06e969d8746b406646294ce1b7
humanhash: white-eleven-queen-pizza
File name:008032020.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:503'926 bytes
First seen:2020-08-04 06:28:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:xJEnyJTaUs2iojaNanoHnWfB7wImYU8vQwAm2jKE1ejdYNBB3Wf5uuKxCtls:xayNTs1oODAE78YwujKEQjdYh3YpFs
TLSH 7AB4231AEA1792945E00BB0DC7E5CC7C0CB0AF2662E917293FCF599088E7E715760B96
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: medona-bd.com
Sending IP: 156.96.46.79
From: export@medona-bd.com
Subject: Re : PUMP ORDER
Attachment: 008032020.zip (contains "008032020.exe")

AgentTesla SMTP exfil server:
mail.ahba.sd:587

AgentTesla SMTP exfil email address:
em.atiq@ahba.sd

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0122db3df94265efafc48b62e961eadd01998a7ec8cb78a174064845cd08e1eb/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 06:30:08 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aernwppzijs67l6ernrosypk3uaztct6zdfxriluazeeltii4hvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0122db3df94265efafc48b62e961eadd01998a7ec8cb78a174064845cd08e1eb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0122db3df94265efafc48b62e961eadd01998a7ec8cb78a174064845cd08e1eb

(this sample)

AgentTesla

Executable exe d3e66e348953a589c9852de7f1b10516f6f7cd1287f33ea12cc6ff44a96e1419

  
Dropping
MD5 5908aac7b6481f918e5e4f900e6664cb
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d3e66e348953a589c9852de7f1b10516f6f7cd1287f33ea12cc6ff44a96e1419

Comments