MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecd2e2455830ef494f3ece6093baa35b16e22beb0e7a50f9810c509bdb831168. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ecd2e2455830ef494f3ece6093baa35b16e22beb0e7a50f9810c509bdb831168
SHA3-384 hash: 572a3853899901e61471a0e71473b9b51b9f2ad6713a14fb52ce68a673c638ba885eec188b58b85239d17f1528c72055
SHA1 hash: 22ac02ac08e9b400c2cb25116bae23c9835d6e3d
MD5 hash: de8043930defeba2128a65059067975b
humanhash: grey-autumn-utah-island
File name:ExportCheckList_22274831_15953_Email.eml____________________________________________________________
Download: download sample
Signature AgentTesla
Create hunting rule
File size:846'297 bytes
First seen:2021-01-19 07:16:27 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:vtrUWnX/60jal/zgJvMVfc+rfERskaViNOqWXYHHhQ0DCQoHMd9JYUuz1s1HPOOn:XNwn1iXfnhQuJ++Cq
TLSH 6A05334FFD5C9214D2A363B9022991A888FDF67ED2AC47F2D1E2762B60930F159D4237
Reporter abuse_ch
Tags:AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail11.digistar.vn
Sending IP: 103.254.14.161
From: ZAHID JAVED <thuydt@tdh-hitech.com.vn>
Subject: Fwd: Hitech Fwd: Re: Invoice no 006(AH)/EXP
Attachment: ExportCheckList_22274831_15953_Email.eml____________________________________________________________ (contains "ExportCheckList_22274831_15953_Email.eml_____________________________________________________________.exe")

AgentTesla SMTP exfil server:
smtp.vivaldi.net:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ecd2e2455830ef494f3ece6093baa35b16e22beb0e7a50f9810c509bdb831168/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-19 07:17:09 UTC
AV detection:
9 of 44 (20.45%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5tjoerkygdxustz6zzqjhovdlmloek7lbz5fb6mbbrijxw4dcfua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ecd2e2455830ef494f3ece6093baa35b16e22beb0e7a50f9810c509bdb831168

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar ecd2e2455830ef494f3ece6093baa35b16e22beb0e7a50f9810c509bdb831168

(this sample)

AgentTesla

Executable exe 13d0dab6cd07635e251a34a31ae7f3f1b993e50c289042cbed7b3d859a6c0f3b

  
Dropping
MD5 8adfad1577b497d68c3677dcb2e96e15
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 13d0dab6cd07635e251a34a31ae7f3f1b993e50c289042cbed7b3d859a6c0f3b

Comments