MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21edcb8d1e3dab14a6bc1501d961cbfd06a9a194fd0038caf8f13eca1b45037d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21edcb8d1e3dab14a6bc1501d961cbfd06a9a194fd0038caf8f13eca1b45037d
SHA3-384 hash: 7dd34258652667483076a7585feb94e66126b1119fd80cade3fd7bbb2ba9c347978a0ccdcab1a5edbc34ea081c1df036
SHA1 hash: 1a96be223b91a0cd5b04924f0bd4537b0e3df724
MD5 hash: bb2797b2e9a0d9ddf731f3d3331e0484
humanhash: black-magnesium-muppet-texas
File name:ORD00086118.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:372'201 bytes
First seen:2020-08-05 09:08:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:tBlF7i1/RoeztYOW+ou0kYi1Chhn9WtZWKp38e9xhAi7:bS/+eztYyUkYiU9cQKpTRJ
TLSH A984238D26BC8D74050E9BE390330D728D6776D0AB6359EF0EA7D0C27685F51AF16839
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: salewa.it
Sending IP: 103.207.39.71
From: Giulia Braghette <giulia.braghette@salewa.it>
Subject: ORD00086118 Salewa
Attachment: ORD00086118.zip (contains "ORD00086118.exe")

AgentTesla SMTP exfil server:
mail.mahavirint.in:587

AgentTesla SMTP exfil email address:
bikash@mahavirint.in

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/21edcb8d1e3dab14a6bc1501d961cbfd06a9a194fd0038caf8f13eca1b45037d/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:10:07 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ehw4xdi6hwvrjjv4cua5syol7udktimu7uadrsxy6e7mug2fan6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/21edcb8d1e3dab14a6bc1501d961cbfd06a9a194fd0038caf8f13eca1b45037d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 21edcb8d1e3dab14a6bc1501d961cbfd06a9a194fd0038caf8f13eca1b45037d

(this sample)

AgentTesla

Executable exe 72cd775d3fe646512fa722847511cedbf004fcf870a7d4df0d5dfd4dd5964915

  
Dropping
MD5 8008d32d54f2efc42bb2440d7555c1c0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 72cd775d3fe646512fa722847511cedbf004fcf870a7d4df0d5dfd4dd5964915

Comments