MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccf7a39b671a887f52335591049453adcca65863fc1b8edd1828d552c23d1ab2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: ccf7a39b671a887f52335591049453adcca65863fc1b8edd1828d552c23d1ab2
SHA1 hash: e89f952697ca071ce245d39fcdcbe6204836e2e9
MD5 hash: 8120add2a389c13703a951ca66400777
File name:EUROCargoFO0005962320.zip
Download: download sample
Signature AgentTesla
File size:400'627 bytes
First seen:2020-05-23 15:27:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:9muRJHIAgVfNI+VtxgEqVdobB2FwPrd40sT6Pg:9m0sVfC+FyduDsYg
TLSH B18423DF61784B8CCA68633C2114C1DE562ADCD7A980D5AD6D80E273371E1C51FA6F8B
Reporter @abuse_ch
Tags:AgentTesla zip


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: plesk5.etllao.com
Sending IP: 202.62.107.252
From: Apicella Elvira <manager@stn-ff.com>
Subject: Re: shipping order for EUROCARGO BARI Import--20/FO00/0596
Attachment: EUROCargoFO0005962320.zip (contains "EUROCargoFO0005962320.exe")

AgentTesla SMTP exfil server:
mail.karmachalets.co.in:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 22
Origin country FR FR
ClamAV SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
VirusTotal:Virustotal results 9.38%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ccf7a39b671a887f52335591049453adcca65863fc1b8edd1828d552c23d1ab2

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments