MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecee04c79d866c80463ebf916c2a6608dd9839d67e34aa64a35250e2b1e6e88a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ecee04c79d866c80463ebf916c2a6608dd9839d67e34aa64a35250e2b1e6e88a
SHA3-384 hash: 9477c54e0520d0bccee95b2c07f432c728e51eb817055e8fb3a4790bcb259fae7a0e413f9651029ff43bdf6d488ebb20
SHA1 hash: bbbde519d61360f98900fc6ec622540bea94dec8
MD5 hash: 99080e70208f45954541766fbbf04a87
humanhash: early-low-cup-lamp
File name:Proforma inv.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:387'528 bytes
First seen:2020-06-08 05:32:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:R9JNGC3k8nAO0tBrRjfsnr7Vx7evUksXYyeTseaxMzFSW/wlIXD39f2bSI:RjNJkWmlrsnrRFevwT+AW/tXD9ubSI
TLSH 61842389A7DD03B3BFDB9F48818B57B4B6ED4935AF8121F19BD8E2510A063181284DFC
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: gproxy7-pub.mail.unifiedlayer.com
Sending IP: 70.40.196.235
From: Power Factor Ltd <sales@powerfactorgh.com>
Subject: proforma
Attachment: Proforma inv.zip (contains "Proforma inv.exe")

AgentTesla SMTP exfil server:
premium71.web-hosting.com:26

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 05:34:05 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5txajr45qzwiarr6x6iwyktgbdozqoowpy2kuzfdkjiofmpg5cfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ecee04c79d866c80463ebf916c2a6608dd9839d67e34aa64a35250e2b1e6e88a

(this sample)

AgentTesla

Executable exe 36adc32ee7a0c83b662d08a804004e8129aaef0cd75e76376ff23f0fe3dd831f

  
Dropping
MD5 bb951ea939722cb2f163d2e46a5ba8a9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 36adc32ee7a0c83b662d08a804004e8129aaef0cd75e76376ff23f0fe3dd831f

Comments