MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ca45d6949c858e433a21b5fb221501e68f0e4da067ef6265b257bb6f3e71ef5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ca45d6949c858e433a21b5fb221501e68f0e4da067ef6265b257bb6f3e71ef5
SHA3-384 hash: 2e781c6b9924678a7ccd7d119b0f8a1cc7cbd177e3853dc786d2ab8bf8eb236cd7466f6a48e3b01dd961c678027cac21
SHA1 hash: a081d2257368f15ca945cf00bef84885612ceb9c
MD5 hash: 578934d4abcb8854630ee96240a53940
humanhash: maine-arizona-autumn-four
File name:Customer Order, Images, Spec.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:316'617 bytes
First seen:2020-12-08 06:35:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:CxqfiP3K3Lp/tN0b3QW5iB+cgjF78gIinjwFhMQdm+rN7c5HC5Y/KjMFGtK:7KPq9FNaSAc+7HXj02Qdm+rNimY/BstK
TLSH D8642378DE0362890735285BE6D5712664B86B17A7D9070B1BF278B9C9E3D393FA0E40
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Kathy Sales<s.ebel@makoba.de>" (likely spoofed)
Received: "from makoba.de (unknown [160.20.147.113]) "
Date: "07 Dec 2020 22:02:04 -0800"
Subject: "Price Request"
Attachment: "Customer Order, Images, Spec.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisE328327846A5.4882.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ca45d6949c858e433a21b5fb221501e68f0e4da067ef6265b257bb6f3e71ef5/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-08 06:36:05 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fssf22kjzbmoim5cdnp3eikqdzupbzg2az7pmjs3ev53n47hd32q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2ca45d6949c858e433a21b5fb221501e68f0e4da067ef6265b257bb6f3e71ef5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2ca45d6949c858e433a21b5fb221501e68f0e4da067ef6265b257bb6f3e71ef5

(this sample)

AgentTesla

Executable exe c04d9dda88a75f4ed924e20617847a4d7a8ff729754e8ad66f3557fb90ed5d25

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c04d9dda88a75f4ed924e20617847a4d7a8ff729754e8ad66f3557fb90ed5d25

Comments