MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e20a94b6770dd68f65e6fd4816bd31311295af939d869dab2e3bcce9743f393. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e20a94b6770dd68f65e6fd4816bd31311295af939d869dab2e3bcce9743f393
SHA3-384 hash: ce7e0d6870b1fced3ddd14ab0fa3392c268e72a1ae3fdbcfb7067d1786cd3702bc326e4bbdfb86b431608fa2cf4a21bf
SHA1 hash: ec5c821282127893ac2faeb0fe0be634d1db831a
MD5 hash: fabdf1a6c8e7e7ed743b5b5d67293ca1
humanhash: foxtrot-echo-sixteen-nebraska
File name:51842594.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:981'904 bytes
First seen:2020-06-10 07:39:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:bxQMToEB8GSn0M2ev6gbI4zlptpUg6gqlthxbyz2Xg:ySMeetjJ/pUp9JyyXg
TLSH A925339AC8B33FDB95DD9C730BD39D835684319BD9E4F632FFA109604698188353286B
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pdlc34160.ciberserver.com
Sending IP: 176.221.34.160
From: SF EXPRESS <mail.delivery@sfexpress.cn>
Subject: SF EXPRESS INVOICE
Attachment: 51842594.zip (contains "51842594.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.AitInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 07:41:05 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fyqkss3hodowr5s6n7kic26tcmisswxzhhmgtwvs4o6m5f2d6ojq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2e20a94b6770dd68f65e6fd4816bd31311295af939d869dab2e3bcce9743f393

(this sample)

AgentTesla

Executable exe af7df7cf389f5be27e5dfaac769693d2ed4f6406b0a9f8dfdc64aaeb469f1d17

  
Dropping
MD5 cfcd474e86bd8e07ab0dab661e6faec5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 af7df7cf389f5be27e5dfaac769693d2ed4f6406b0a9f8dfdc64aaeb469f1d17

Comments