MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee07f6370ede7ad99079e7ec624cac5823d451ce5529496af366fda7e554f6d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee07f6370ede7ad99079e7ec624cac5823d451ce5529496af366fda7e554f6d7
SHA3-384 hash: 123b9373d403a5d1c60e0597be5a0824a74901651490a0cd410c50637e3e741692325e46d7c17b65fff74c55977eab40
SHA1 hash: fbbffc0c72efba93fa1e3825c7814e68d89fec60
MD5 hash: 225066a6a1fcd8b9e6dd44019a32d72e
humanhash: hawaii-east-earth-hotel
File name:Quotation.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:431'915 bytes
First seen:2020-05-04 21:20:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Sg70yK+3hr3ABmUyZW8DkR0mZrkJIaXn+Wk:uyKcVWm3GZrk9+X
TLSH 279423189BF2C110C3DE71691AF17F9FE92429679B0536BFE4012018E725937DB2F8A6
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: Piquadro.com
Sending IP: 103.145.253.9
From: Serena Vanzini <info@Piquadro.com>
Subject: RE: Piquadro, Italy 2204021 rev 1 dated 30.04.2020
Attachment: Quotation.zip (contains "Quotation.exe")

AgentTesla SMTP exfil server:
mail.scandinavian-collection.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.39524.11417.4031.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21199.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 09:25:35 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5yd7mnyo3z5ntedz47wgetfmlar5iuookuuus2xtm362pzku63lq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ee07f6370ede7ad99079e7ec624cac5823d451ce5529496af366fda7e554f6d7

(this sample)

AgentTesla

Executable exe d3ccfc7eefe685bc703f2975cde7560c851f7e28f8fac127baf54b24ede4ca91

  
Dropping
MD5 e1a68793a7d62a16837c95b2cc38da0e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d3ccfc7eefe685bc703f2975cde7560c851f7e28f8fac127baf54b24ede4ca91

Comments