MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12882b54a8dda6cc782150be3a369aa64354a0c4dc4d4ba0bedf74660302126b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12882b54a8dda6cc782150be3a369aa64354a0c4dc4d4ba0bedf74660302126b
SHA3-384 hash: 03735657fe1c7cd045757fb26131294f7fad60f0281d63573b15bd2d58e426f300deaf7a79d415ce44b8a5170d6d6eba
SHA1 hash: b586097de02616a86c960ccc794fda6a7459597f
MD5 hash: 7adf436869a0154e6f477057d56d55b6
humanhash: wyoming-may-arkansas-asparagus
File name:payment_copy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:501'724 bytes
First seen:2020-06-15 13:12:43 UTC
Last seen:2020-06-15 14:56:00 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:TNG6Tyth3DNyYW0E3mIYx4IJJpN0SJt4V/Np1z:TCth3DQYW0E3mIYO4JpNZt4V/Nf
TLSH F0B4239FB8160579AE0E3C0EC2DA57F9B5964A9B3DC00902E4C65CDDCE59E07FA92B04
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: slot0.en-plasnic.com
Sending IP: 45.58.39.117
From: goods@en-plasnic.com
Subject: Payment Confirmation
Attachment: payment_copy.zip (contains "payment_copy.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25080.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23482.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 13:14:07 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ckecwvfi3wtmy6bbkc7dunu2uzbvjige3rguxif6352gmayccjvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 12882b54a8dda6cc782150be3a369aa64354a0c4dc4d4ba0bedf74660302126b

(this sample)

AgentTesla

Executable exe a98bc56a3689009619845fc3491c944ee12408cfe457e0a59fb2fae808c784f2

  
Dropping
MD5 3e720d22703dca6b558d1eb8bd522d84
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a98bc56a3689009619845fc3491c944ee12408cfe457e0a59fb2fae808c784f2

Comments