MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b72240df44d08e590e8741cfc57d27d2b3f748e2040db1ccbe7f0c4abb57f2e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b72240df44d08e590e8741cfc57d27d2b3f748e2040db1ccbe7f0c4abb57f2e8
SHA3-384 hash: 197a73f8c2603b9a45988dbd72e70d77382bdcc4d21ee404618dc88dc2759c2250a07cf4915377051950740be74a8566
SHA1 hash: f8bb1a13d57bd8ca86b9a16bcb4e042807e79436
MD5 hash: a30712a9ee022f2cfa27c8b41d980f4a
humanhash: floor-florida-nevada-kilo
File name:Booking.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:596'126 bytes
First seen:2021-01-13 07:28:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:IGlnnwhANSM+ETWXauHcyOP9sAwqi7KVgSR5G+op92ejx1M:plyztKu8yOFsAwEVgSaV/2K7M
TLSH CEC4233CE93445B2863D4E5AF5A29057C23C74364B2DE0CC3FDB497D92B2A9914C29D6
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: secure.zrl.com.zm
Sending IP: 216.194.164.118
From: info <clement.mwanza@zrl.com.zm>
Subject: Booking Error
Attachment: Booking.zip (contains "Booking.exe")

AgentTesla SMTP exfil server:
smtp.westenderinn.us:587

AgentTesla SMTP exfil email address:
reservations@westenderinn.us

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.32504.20589.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b72240df44d08e590e8741cfc57d27d2b3f748e2040db1ccbe7f0c4abb57f2e8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-13 07:29:06 UTC
AV detection:
13 of 44 (29.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w4rebx2e2chfsduhihh4k7jh2kz7oshcaqg3dtf6p4gevo2x6lua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b72240df44d08e590e8741cfc57d27d2b3f748e2040db1ccbe7f0c4abb57f2e8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b72240df44d08e590e8741cfc57d27d2b3f748e2040db1ccbe7f0c4abb57f2e8

(this sample)

AgentTesla

Executable exe 450f7d91e80c562310d464e2d0cebaa1ca6e0c475b29dda096fdeee69343701d

  
Dropping
MD5 be4013ed4e9fc8135904614cc4cba168
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 450f7d91e80c562310d464e2d0cebaa1ca6e0c475b29dda096fdeee69343701d

Comments