MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2e243beb80a79eb91a3d2beecdc4faaa5d66ee499440f613785edd706b23cec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e2e243beb80a79eb91a3d2beecdc4faaa5d66ee499440f613785edd706b23cec
SHA3-384 hash: 63f72cca7407c259cb3d161187866ddbca567efb69a571e1eb82a8de6582ef29e299bce83ed357cfbce5bca1ced95f2d
SHA1 hash: 426adfe648b7dbd9f411fb328a80091ca53419f2
MD5 hash: a8220a31015a8cda5cfda60eddb12e47
humanhash: texas-minnesota-florida-vermont
File name:Invoice.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:415'510 bytes
First seen:2020-08-06 05:45:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:TlvCzKM5vXJKBw7PzSELg8ft5Zdd1GecMQ6Q4Vw1E:dOKM5xK+hE8fldPd8zkw2
TLSH DD9423405800EB6898B78B165B0B645FCCC2F3ACD69817B1C715BBBC4BA5CE467CA4CE
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smtprelay.b.hostedemail.com
Sending IP: 64.98.42.44
From: Beverly - Your Celebrant and Ceremony <beverly@yourcelebrantandceremony.com>
Reply-To: beverly@yourcelebrantandceremony.com
Subject: Re: Confirm PerformTex Order Amount PI#0712
Attachment: Invoice.zip (contains "xUeolpdaadrSzyA.exe")

AgentTesla SMTP exfil server:
mail.orbingenieria.com:587

AgentTesla SMTP exfil email address:
money@ashok-photos.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e2e243beb80a79eb91a3d2beecdc4faaa5d66ee499440f613785edd706b23cec/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:47:04 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4lrehpvybj46xend2k7ozxcpvks5m3xetfca6yjxqxw5obvshtwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/e2e243beb80a79eb91a3d2beecdc4faaa5d66ee499440f613785edd706b23cec

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e2e243beb80a79eb91a3d2beecdc4faaa5d66ee499440f613785edd706b23cec

(this sample)

AgentTesla

Executable exe 2303d08c9c8f35e63306c76d1c12aa08f963082214151638bf9d2390b43c14d3

  
Dropping
MD5 73e6206c14e1a2a9e225b14ff7a9528c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2303d08c9c8f35e63306c76d1c12aa08f963082214151638bf9d2390b43c14d3

Comments