MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70beb55033863d9e54557f596a70d86b451ec193a5b52ad1d17f50512245e4c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara Comments

SHA256 hash: 70beb55033863d9e54557f596a70d86b451ec193a5b52ad1d17f50512245e4c2
SHA3-384 hash: fe2fa1305f8b5d5c916c0ed37c0404a6f536a74eea5b93a115a4bdd284740460c96e293874b851b673693bfe62baef7a
SHA1 hash: 081c9478f903adc26e5c2567ae7dcbf0ad5f0117
MD5 hash: 847cf108698a7de7417ada35d58c9e27
humanhash: eleven-missouri-twelve-video
File name:Requested Order pdf.7Z
Download: download sample
Signature AgentTesla
File size:410'798 bytes
First seen:2020-06-30 08:54:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Qf6LZgO0sKJNcxw967AtpjoS2J+uFcm9rxJyGN8DJtCc:QYZZlKJaxw967AzoS2px9rxJQDJtCc
TLSH DF94236EA19A2FF7558D29B85A7FBB52B001C8C56D22AB1353C4DE7113C9C09EF48DC8
Reporter @abuse_ch
Tags:7z AgentTesla


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: mail.eldorado.com.uy
Sending IP: 190.64.204.53
From: Mayra Labadie <mlabadie@eldorado.com.uy>
Subject: Send June Order PI
Attachment: Requested Order pdf.7Z (contains "requested order pdf.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 25
Origin country US US
ClamAV SecuriteInfo.com.Generic-EXE.UNOFFICIAL
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/70beb55033863d9e54557f596a70d86b451ec193a5b52ad1d17f50512245e4c2/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 04:51:29 UTC
AV detection:22 of 48 (45.83%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:Virustotal results 9.23%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 70beb55033863d9e54557f596a70d86b451ec193a5b52ad1d17f50512245e4c2

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments