MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccf7a39b671a887f52335591049453adcca65863fc1b8edd1828d552c23d1ab2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ccf7a39b671a887f52335591049453adcca65863fc1b8edd1828d552c23d1ab2
SHA3-384 hash: 8dd412201b6f75c7ba6bd15c7f64283dd66da813b691efd44633c5904f4d66b2905a741b5b187ef56a764da8ecc8b720
SHA1 hash: e89f952697ca071ce245d39fcdcbe6204836e2e9
MD5 hash: 8120add2a389c13703a951ca66400777
humanhash: michigan-snake-uncle-timing
File name:EUROCargoFO0005962320.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:400'627 bytes
First seen:2020-05-23 15:27:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:9muRJHIAgVfNI+VtxgEqVdobB2FwPrd40sT6Pg:9m0sVfC+FyduDsYg
TLSH B18423DF61784B8CCA68633C2114C1DE562ADCD7A980D5AD6D80E273371E1C51FA6F8B
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: plesk5.etllao.com
Sending IP: 202.62.107.252
From: Apicella Elvira <manager@stn-ff.com>
Subject: Re: shipping order for EUROCARGO BARI Import--20/FO00/0596
Attachment: EUROCargoFO0005962320.zip (contains "EUROCargoFO0005962320.exe")

AgentTesla SMTP exfil server:
mail.karmachalets.co.in:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-23 15:35:40 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
21 of 47 (44.68%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ccf7a39b671a887f52335591049453adcca65863fc1b8edd1828d552c23d1ab2

(this sample)

AgentTesla

Executable exe 0fdd378395c3c909429366bdd2d59fc8d2a04e47d9954b101da81be15b583c77

  
Dropping
MD5 02ad34cc75ffd8091df65b7f4c0b0ab4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0fdd378395c3c909429366bdd2d59fc8d2a04e47d9954b101da81be15b583c77

Comments