MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ec65850335ec681a3eeff1a5aaa05485fa5997bbe3c669eb1bda9100bb3d67b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ec65850335ec681a3eeff1a5aaa05485fa5997bbe3c669eb1bda9100bb3d67b
SHA3-384 hash: 99501750ee3721e9104eda01ee0a06b2a63b0aa7b21b7961c1bf5be9da2dd55dbbe0ecf3d1fa4dad19eeccc3d4352d6a
SHA1 hash: d475a247ff458f0b25be868a53c1cae13f78d265
MD5 hash: 027154360c373f7f09bc0d4fe6605340
humanhash: vegan-beryllium-illinois-nuts
File name:invoice 1.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:332'239 bytes
First seen:2020-05-05 07:04:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Brm9PZ8s79FOhgi2jF1WLPw7W0TFvoC1djd2KnIAmfG6Oab2BdQEQRi9ru:Fmdy2wgxFQP2f1djFM1MjSi9S
TLSH 9464237B356FAB696C9211271E24E454C39FF478A828934CF844E0157AC0FAAFE6F1C5
Reporter abuse_ch
Tags:AgentTesla geo TUR zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ns2.ugotmail.net
Sending IP: 91.84.158.163
From: Mrs. Melek AKBAS <melek@alkin.com.tr>
Reply-To: info@marmarayem.com.tr
Subject: Proforma Invoice
Attachment: invoice 1.zip (contains "invoice.exe")

AgentTesla SMTP exfil server:
smtp.ionos.es:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.KillProc2.10282.25399.14214.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21615.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23810.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 07:35:44 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b3dfqubtl3didi7o74nfvkqfjbp2lgl3xy6gnhvrxwurac5t2z5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0ec65850335ec681a3eeff1a5aaa05485fa5997bbe3c669eb1bda9100bb3d67b

(this sample)

AgentTesla

Executable exe d5414c39cce4d671db2abfc5879a2a2e97a60313070d37c359b01b50f201aed2

  
Dropping
MD5 1408f36656fc33e202b9c94a1a1e834f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d5414c39cce4d671db2abfc5879a2a2e97a60313070d37c359b01b50f201aed2

Comments