MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e710ac9471463cb16b10202323c939a2c2b5e9574c15e3a136f63f5f9fbb7e06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e710ac9471463cb16b10202323c939a2c2b5e9574c15e3a136f63f5f9fbb7e06
SHA3-384 hash: cffa1ed7ebe819c6ef6862e9a08c8d827df67d2fa0f9967113939c8af3d6c9a1327303cdc560f930dbebb69b77d37045
SHA1 hash: 8c2ab3c5ff7a3d8516d914abb4376fc42badd8de
MD5 hash: 1d89fab4d5e6ac3b2ed2b676656cc5df
humanhash: lake-arkansas-spring-yankee
File name:Zahlung 2.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:567'022 bytes
First seen:2020-11-20 07:57:23 UTC
Last seen:2020-11-20 19:17:14 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:vY3oPhlhbimOBDrYS1CmZap3G9htvbDa7Vx+rvomLL:vDpb32DrYG8p3G9htva7VxCvxn
TLSH 07C423223ED5EB89E0F78DB5A23E90E40C368D6E99DA454B2EDB1C3414772F10B2539D
Reporter abuse_ch
Tags:AgentTesla DEU geo zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.linux55.papaki.gr
Sending IP: 136.243.171.45
From: BMW Trading GmbH <account@tospititonmikron.gr>
Subject: Re: Zahlung - Invoices
Attachment: Zahlung 2.zip (contains "Zahlung.exe")

AgentTesla SMTP exfil server:
mail.greatdeck.co:587

AgentTesla SMTP exfil email address:
info.greatdeck@greatdeck.co

Intelligence

File Origin
# of uploads :
2
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e710ac9471463cb16b10202323c939a2c2b5e9574c15e3a136f63f5f9fbb7e06/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-20 07:58:05 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=44ikzfdriy6lc2yqearshsjzulbll2kxjqk6hijw6y7v7h53pyda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e710ac9471463cb16b10202323c939a2c2b5e9574c15e3a136f63f5f9fbb7e06

(this sample)

AgentTesla

Executable exe b0e2a48f26cb005f0fdf7b25701e9a882caa5d4d26bfed5e7750c14114f7b03c

  
Dropping
MD5 fcb003cb6c98c1a4b4e864aa92dfb39c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b0e2a48f26cb005f0fdf7b25701e9a882caa5d4d26bfed5e7750c14114f7b03c

Comments