MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70beb55033863d9e54557f596a70d86b451ec193a5b52ad1d17f50512245e4c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70beb55033863d9e54557f596a70d86b451ec193a5b52ad1d17f50512245e4c2
SHA3-384 hash: fe2fa1305f8b5d5c916c0ed37c0404a6f536a74eea5b93a115a4bdd284740460c96e293874b851b673693bfe62baef7a
SHA1 hash: 081c9478f903adc26e5c2567ae7dcbf0ad5f0117
MD5 hash: 847cf108698a7de7417ada35d58c9e27
humanhash: eleven-missouri-twelve-video
File name:Requested Order pdf.7Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'798 bytes
First seen:2020-06-30 08:54:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Qf6LZgO0sKJNcxw967AtpjoS2J+uFcm9rxJyGN8DJtCc:QYZZlKJaxw967AzoS2px9rxJQDJtCc
TLSH DF94236EA19A2FF7558D29B85A7FBB52B001C8C56D22AB1353C4DE7113C9C09EF48DC8
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.eldorado.com.uy
Sending IP: 190.64.204.53
From: Mayra Labadie <mlabadie@eldorado.com.uy>
Subject: Send June Order PI
Attachment: Requested Order pdf.7Z (contains "requested order pdf.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/70beb55033863d9e54557f596a70d86b451ec193a5b52ad1d17f50512245e4c2/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 04:51:29 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oc7lkubtqy6z4vcvp5mwu4gynncr5qmtuw2svuorp5ifcisf4tba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 70beb55033863d9e54557f596a70d86b451ec193a5b52ad1d17f50512245e4c2

(this sample)

AgentTesla

Executable exe b8aecbdc29f182fafff84d4199a808d915eb37488a8fe666e308267aba5e648e

  
Dropping
MD5 3a1f0c85d81e3e6cb81e933a5aba35f9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b8aecbdc29f182fafff84d4199a808d915eb37488a8fe666e308267aba5e648e

Comments