MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d7980fc9173b3e66e2172a121dde9cbb6c45d15ea8ef358242753574d8a1366. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d7980fc9173b3e66e2172a121dde9cbb6c45d15ea8ef358242753574d8a1366
SHA3-384 hash: f0bfd8702d5429f6629b7cd2ed7c941c8a663eb1df02b7d66914bba351e99c6269545ebb8c86593402fb45c87d17c90e
SHA1 hash: 8150bf4142047e4c45add1278bfc73081bb4d0e4
MD5 hash: 644c202847796a2d59ef94dc5992654e
humanhash: pip-fanta-william-quebec
File name:Order89989001.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:671'747 bytes
First seen:2020-05-07 15:24:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:cAPfujZAzb5QoUkHGDrChR9EplUkZt6DNzGGzwtUoESU5parGC1OIQ:cEf1zb5Q8HUChbelUdzgUopUzarGCFQ
TLSH 9DE42368E7C51880D9EF08B632A693D64717118D664877E2CE0DD30C05F5BA4BB4EFAB
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

Sending IP: 45.95.169.128
From: info@inonioge.com
Subject: AW:AW:AW
Attachment: Order89989001.zip (contains "Invoice001.exe")

AgentTesla SMTP exfil server:
smtp.ionos.es:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21103.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 15:35:53 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dv4yb7erooz6m3rbokqsdxpjzo3mixiv5khpgwbee5jvotmkcnta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1d7980fc9173b3e66e2172a121dde9cbb6c45d15ea8ef358242753574d8a1366

(this sample)

AgentTesla

Executable exe 6301769547ccadd844e6dd6d8ac4b40258698d5cc3133aa8068fc623af8aba7b

  
Dropping
MD5 4d066994f6ed62e4fe9169c2d36610f0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6301769547ccadd844e6dd6d8ac4b40258698d5cc3133aa8068fc623af8aba7b

Comments