MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30ddff238f3725782d7794c8a62bd7fd2c7c1ec58d2283858807d2a5042cf347. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 30ddff238f3725782d7794c8a62bd7fd2c7c1ec58d2283858807d2a5042cf347
SHA1 hash: 2e3506619c23cd8e3859fd9357f9c37991769fe2
MD5 hash: 5d18207b79119126c746dc48f4db0960
File name:payment. 4029530.iso.zip
Download: download sample
Signature AgentTesla
File size:1'032'584 bytes
First seen:2020-05-22 10:08:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:WlKImBUa9FTveb3jkvW2vqOmCz5yf7S486s88sz4:WlKlDeb3YvZyPCyOLj88y4
TLSH 8225333650615EF6F22FF75E4458233F093FA023FE8691952A6F1AB6DB016C02D4CA79
Reporter @abuse_ch
Tags:AgentTesla zip


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: solid-me.com
Sending IP: 103.99.1.148
From: Ayman Al Kottob<ayman@solid-me.com>
Subject: RE:Order Prepayment _ BankCopy
Attachment: payment. 4029530.iso.zip (contains "payment. 4029530.iso.exe")

AgentTesla SMTP exfil server:
mail.pptoursperu.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Medium
# of uploads 1
# of downloads 23
Origin country US US
ClamAV Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
VirusTotal:Virustotal results 21.21%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 30ddff238f3725782d7794c8a62bd7fd2c7c1ec58d2283858807d2a5042cf347

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments