MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecb448d3b0c7d86ffc87e6c8a073bce412e7767826bf505ec4d26b9f799100dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ecb448d3b0c7d86ffc87e6c8a073bce412e7767826bf505ec4d26b9f799100dc
SHA3-384 hash: 6bb6195ac3d0ccfa7a7b80176585274f84b84e26f2a5bb2b08e0695db95f009714c81a903e19d35f1f585bef71fa649f
SHA1 hash: 2d196212b8819c7fde8d8c3c83b5d66b62a29f64
MD5 hash: 18fe59231dfa9b9e91a054893ba58cc0
humanhash: alaska-thirteen-juliet-summer
File name:PO 229562.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:580'476 bytes
First seen:2020-11-17 06:04:42 UTC
Last seen:2020-11-17 06:05:40 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:sAukiVtPqoaz1ZbnPGK2oJGhFFFCsWDirl99E/Uvqq:rpuSz1R+K2oUhnFCH9/Uvqq
TLSH 18C423171E87B0BC82DC95E2681F3B62506B961759B98013D647F41EF1CA7E3AFC828D
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "purchases@vnkc.com" (likely spoofed)
Received: "from vnkc.com (unknown [103.153.78.33]) "
Date: "16 Nov 2020 15:15:14 -0800"
Subject: "New Order, PO-229562"
Attachment: "PO 229562.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20201117-0009.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ecb448d3b0c7d86ffc87e6c8a073bce412e7767826bf505ec4d26b9f799100dc/
Threat name:
ByteCode-MSIL.Trojan.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-11-16 21:59:34 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ecb448d3b0c7d86ffc87e6c8a073bce412e7767826bf505ec4d26b9f799100dc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ecb448d3b0c7d86ffc87e6c8a073bce412e7767826bf505ec4d26b9f799100dc

(this sample)

AgentTesla

Executable exe d5269c737f5691eab59bcc8c6ba21a4ad0244e37d87c2fae38543ad15aa6707f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d5269c737f5691eab59bcc8c6ba21a4ad0244e37d87c2fae38543ad15aa6707f

Comments