MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0297de22b433fe7ecee63b5f80b78c4749bb8f4cfec0cd737713d87781d1db52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0297de22b433fe7ecee63b5f80b78c4749bb8f4cfec0cd737713d87781d1db52
SHA3-384 hash: 2cfd4ba94e8b1c3ee211b246671345a8b55d61c75df145bad5531f87bb168a16311e2d76ed3b99a94e96e7f07f4e1b12
SHA1 hash: 396d67661068020cc743b05e97df210b3912534d
MD5 hash: e1bbf29e91649fd3a3c7a6b20a301860
humanhash: jupiter-pizza-pluto-batman
File name:30% as deposit slip of 6 units_images.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:275'112 bytes
First seen:2020-06-28 07:27:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:63VK7KSRRxm5iw567WPNqFWKbdSkuOVZ93BE5:VmGRxm5iw56cyBYkuO5C
TLSH D84422BE6C75F25C34E8FD990C083A9E64E775CC6005DA199998E7E48795CE3E40B833
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.example.com
Sending IP: 45.147.162.82
From: ALMY TRADING COMPANY <admin@genoram.tk>
Subject: 回复: 回复:30% as deposit slip of 6 units 6 x 4 Tractor Truck in the amount of $ 80,523.00 only
Attachment: 30% as deposit slip of 6 units_images.zip (contains "import_documents.exe")

AgentTesla SMTP exfil server:
smtp.office365.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.348.23243.23577.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0297de22b433fe7ecee63b5f80b78c4749bb8f4cfec0cd737713d87781d1db52/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-28 07:28:04 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=akl54ivugp7h5txghnpybn4mi5e3xd2m73am243xcpmhpaor3nja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0297de22b433fe7ecee63b5f80b78c4749bb8f4cfec0cd737713d87781d1db52

(this sample)

AgentTesla

Executable exe 87c88de3a875c7997a34e00e8c7c97577f046332811dcef6cba7c33b37c42396

  
Dropping
MD5 22f207e5e15c4ec19b80e07fa45967b9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 87c88de3a875c7997a34e00e8c7c97577f046332811dcef6cba7c33b37c42396

Comments