MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33108466122311c38b4ec9294c5eae53895fc7c9504b679fe37c7399278da627. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33108466122311c38b4ec9294c5eae53895fc7c9504b679fe37c7399278da627
SHA3-384 hash: 2f0e2022568135677c9535e945e3fb2999fa3ecb6a45bbed6902811e250c7532b7c90cb0d470e73da92c53fb28675a16
SHA1 hash: bfac3667259c0cd0c93a3f7cf9b9f408db2e9563
MD5 hash: d461263c4201185b34bc926904bd7629
humanhash: carpet-skylark-eight-hot
File name:Catalogue.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:478'391 bytes
First seen:2020-05-07 06:44:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:/LFzEGI9DzLsZzt94nYV1jBlLtTd+9ElfaFEEfuEBSe+HW7aNhYASdlrjvrjSfwz:/zCHs441VlLtTd+9sfaGSuGzpCAL0JLO
TLSH C9A423D0161AE570494FA1A4F154AE4C088BDFD11BB6F2F4B45A4EC7F6CBB861E1AE20
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: eurostarinc.com
Sending IP: 37.49.230.216
From: "Rohan Virmani" <ron@eurostarinc.com>
Reply-To: "Rohan Virmani" <ron@eurostarinc.com>
Subject: Catalogue Order Ready
Attachment: Catalogue.zip (contains "catalogue.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22655.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 08:26:47 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gmiiizqsemi4hc2ozeuuyxvokoev7r6jkbfwph7dprzzsj4nuytq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 33108466122311c38b4ec9294c5eae53895fc7c9504b679fe37c7399278da627

(this sample)

AgentTesla

Executable exe d43c6aba8577d6f6e846545d25587748ff13e676320936f4c3104ba94e22e24c

  
Dropping
MD5 1c098e2524570249e1aa01afe50f3dde
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d43c6aba8577d6f6e846545d25587748ff13e676320936f4c3104ba94e22e24c

Comments