MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0086eee7d1ee35ecf7421113b9b13922ff6d040f2eca5130ac6e7f4c2b27b3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0086eee7d1ee35ecf7421113b9b13922ff6d040f2eca5130ac6e7f4c2b27b3d
SHA3-384 hash: 90339112efdf08e87b712cf3e1c033251db3b80f212d022ac76c3dec57e5ac3a2bd9ce2368d91fea5deb3eaa05e0f29c
SHA1 hash: 665d2ae13e1c4c51a98cda62b3d736da564d7c12
MD5 hash: 063166ae6b08a9c991210f59103aab3b
humanhash: queen-oxygen-triple-utah
File name:citat.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:340'596 bytes
First seen:2020-07-06 14:44:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:1GOImI3h6u159aJ6zdmKyVoYYvEHvDSxsNybNM130kk6J+mtuw:emu5k04KyiJvErIsgeJ6GV
TLSH FD7423CB07EA97914A51246841C50F9E291B7897CECF87BB72DBE5DDE9276020C060FE
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pl9.fakat.net
Sending IP: 159.69.67.214
From: Diana Olariu <diana.olariu@spedorient.com>
Subject: Orient
Attachment: citat.zip (contains "citat.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e0086eee7d1ee35ecf7421113b9b13922ff6d040f2eca5130ac6e7f4c2b27b3d/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 14:46:06 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4aeg53t5d3rv5t3ueeitxgytsix7nuca6lwkkeyky3t7jqvspm6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e0086eee7d1ee35ecf7421113b9b13922ff6d040f2eca5130ac6e7f4c2b27b3d

(this sample)

AgentTesla

Executable exe fd26229099bd979d8cedf9b694ea9417a0b82dda9f17b218a1dd445015c47277

  
Dropping
MD5 e9567d62f6cbad2e5c23cc82f5f62377
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fd26229099bd979d8cedf9b694ea9417a0b82dda9f17b218a1dd445015c47277

Comments