MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33bf0ecbb5d80a8866fba59289b7a15b69e80f87589635e45f1ddc5da46dfcf8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence File information Yara Comments

SHA256 hash: 33bf0ecbb5d80a8866fba59289b7a15b69e80f87589635e45f1ddc5da46dfcf8
SHA3-384 hash: 4fc30cf030f87a3a85fbab1157eed91a81f4069edde4c7802274c6cf3936015f429edcca56b34f4494947919ae774858
SHA1 hash: 74b60b33fdb1278b7718901153a1173d5a78dabe
MD5 hash: 15f5b07f42c4fed0df078083f36607ab
humanhash: oranges-jupiter-black-autumn
File name:payment.img
Download: download sample
Signature AgentTesla
File size:1'245'184 bytes
First seen:2020-06-30 05:19:11 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:lAdwd5wWYfnjF3tvWbNwijE32xi7lXJtXgs5f:lrdpenjF3sNjjEGUBXN5
TLSH 7A45F128361D793BC9B81CF980D2650413B5A4723963F7E96ECC61D813EABED0741A7B
Reporter @abuse_ch
Tags:AgentTesla img


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: secure.zrl.com.zm
Sending IP: 216.194.164.118
From: bubaya.malambo@zrl.com.zm
Subject: Fwd- Payment ....
Attachment: payment.img (contains "payment.exe")

AgentTesla SMTP exfil server:
mail.blueink.co.tz:587

AgentTesla SMTP exfil email address:
greatestdad727@gmail.com

Intelligence


File Origin
# of uploads :
1
# of downloads :
28
Origin country :
FR FR
Mail intelligence
Geo location:
Global
Volume:
Low
Vendor Threat Intelligence
Threat name:
ByteCode-MSIL.Trojan.Npe
Status:
Malicious
First seen:
2020-06-29 20:30:53 UTC
AV detection:
18 of 31 (58.06%)
Threat level
  2/5

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

img 33bf0ecbb5d80a8866fba59289b7a15b69e80f87589635e45f1ddc5da46dfcf8

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments