MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ead7741004ecf869aae9c650612c53a35a19dc4cdf1a96327e0f0ee345fc148. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ead7741004ecf869aae9c650612c53a35a19dc4cdf1a96327e0f0ee345fc148
SHA3-384 hash: f36d30a32f288b337b6b3afe638badc8183c25b7fc1a95e5aea56e347b2322637ce0af136c2153e1ebb0f733897a083f
SHA1 hash: 42b6d5b6f928b3d8dac9272d1fe516cd46bda06d
MD5 hash: b190fc247a81a163103d697a7e7bfa6b
humanhash: potato-chicken-eight-eight
File name:PDF Updated Price list.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'076'430 bytes
First seen:2020-05-15 07:30:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:bHLyl+4Wf0uMtl+2JNK2iHXsMelTtYCr+XgCH12D+/W3e/cUBazT:CV5tl+h8TTLrU12i/W34BwT
TLSH AF3533F6D149EC3B11C816F3EA710BE22DFA9FF5EC458957F18E92A894849611BF8031
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: s111-ir-cpanel-trade.maindns.net
Sending IP: 185.165.116.18
From: THINNAKORN VIROTE <info-nagasaki@psscombine.com>
Reply-To: account-nagasaki.posscombine@gmail.com
Subject: Re: Inflated price list
Attachment: PDF Updated Price list.zip (contains "PDF Updated Price list.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Aitinject
Create hunting rule
Status:
Malicious
First seen:
2020-05-15 07:36:10 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f2wxoqiaj3hyngvotrsqmewfhi22dhoezxy2syzh4dyo4nc7yfea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2ead7741004ecf869aae9c650612c53a35a19dc4cdf1a96327e0f0ee345fc148

(this sample)

AgentTesla

Executable exe 9abbf24b322068da5ac2e1581827d788d787eb8b31685863b1aa048f01ca5190

  
Dropping
MD5 5c8f901c4fc6de5013ae75e6d8f7aba4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9abbf24b322068da5ac2e1581827d788d787eb8b31685863b1aa048f01ca5190

Comments