MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba01df6adfb3ba0036b6842e14d12fa453e9bc0ab816db81ed01922ae060b1bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba01df6adfb3ba0036b6842e14d12fa453e9bc0ab816db81ed01922ae060b1bc
SHA3-384 hash: 64581e590b462fb61e3fc6be4cabd2079c29551c678c530e28cd19dccf297eae3d377fc20e9f73445d40663bc6e85570
SHA1 hash: c0d56ab40c2332bd14c55bd39d36d5346146733f
MD5 hash: 999ca1102c1ea692e6f1e2040ba5e10b
humanhash: table-indigo-wisconsin-tango
File name:1332000.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:434'566 bytes
First seen:2020-08-06 05:43:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:hnt/of5XSb9vdlp8qdE21lY+zmdpQn/79NWCkJr99GQgpj5dfasHRARTPptyqp3o:vJhvdrRlHCf+eC0rjGQgpKsHEjJbJC
TLSH CA9423270A45D32E64CF8A0C4757C0E70860A94DB1FC4ED7AA2FD6F9876E1139772A4E
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: longfanshipping.com
Sending IP: 103.133.106.25
From: jack@longfanshipping.com <jack@longfanshipping.com>
Subject: Shipping Documents
Attachment: 1332000.zip (contains "1332000.exe")

AgentTesla SMTP exfil server:
mail.tolipgoldenplaza.com:587

AgentTesla SMTP exfil email address:
dir.fb@tolipgoldenplaza.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba01df6adfb3ba0036b6842e14d12fa453e9bc0ab816db81ed01922ae060b1bc/
Threat name:
ByteCode-MSIL.Trojan.Hesv
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:45:04 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xia562w7wo5aanvwqqxbjujpurj6tpakxalnxapnagjcvydawg6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ba01df6adfb3ba0036b6842e14d12fa453e9bc0ab816db81ed01922ae060b1bc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ba01df6adfb3ba0036b6842e14d12fa453e9bc0ab816db81ed01922ae060b1bc

(this sample)

AgentTesla

Executable exe a044953a724f642c119477d17d23e389c44068773739e51d1b996cd6b2f51f4f

  
Dropping
MD5 997fbde85639834481305ad52fe98405
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a044953a724f642c119477d17d23e389c44068773739e51d1b996cd6b2f51f4f

Comments