MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee440f1bd16a1cec16a20bf3cb52df74bb70a523ac4c8a0d04c0ab9606cd3b62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee440f1bd16a1cec16a20bf3cb52df74bb70a523ac4c8a0d04c0ab9606cd3b62
SHA3-384 hash: 54214dd20c2096fd48b99732f68f230d382ac153c0143da83fd611fd5ff6176bb916621177adbdaf8d6f3f9add000d05
SHA1 hash: 715fdb1f8a0491272c8133933959d403bbfd3f85
MD5 hash: 76d7049a611f5dcfddc50ed3006d9c82
humanhash: william-low-colorado-johnny
File name:order PO-1902082_pdf.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:535'265 bytes
First seen:2020-07-22 06:34:07 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:JuYs+WWFg1SXgs1Npvtw6xKLZ7wo51xpIV8KLVa8wDY3NDQkfuGC+qm:JuYs+fg1hsPw6xUyods8+tSY3FuGCG
TLSH 59B4238CEBF669E1DE773368EE7C5AC009812CE702F54513A7A31CE512BD36AD242943
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: smarthost2.gohsphere.com
Sending IP: 199.127.218.12
From: SHIBIN V <abbas.osman@apcontra.com>
Subject: New RFQ order PO-1902082
Attachment: order PO-1902082_pdf.gz (contains "order PO-1902082_pdf.exe")

AgentTesla FTP exfil server:
trirekaperkasa.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee440f1bd16a1cec16a20bf3cb52df74bb70a523ac4c8a0d04c0ab9606cd3b62/
Threat name:
ByteCode-MSIL.Trojan.MassLogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 06:36:01 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5zca6g6rniooyfvcbpz4wuw7os5xbjjdvrgiudieycvzmbwnhnra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ee440f1bd16a1cec16a20bf3cb52df74bb70a523ac4c8a0d04c0ab9606cd3b62

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz ee440f1bd16a1cec16a20bf3cb52df74bb70a523ac4c8a0d04c0ab9606cd3b62

(this sample)

AgentTesla

Executable exe 2dafd5f1570c579446d2b06ba815302da926c49683a36fe643241f1bd2144ac0

  
Dropping
MD5 92bcb2eb9fd31efafcdf6a943220d650
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2dafd5f1570c579446d2b06ba815302da926c49683a36fe643241f1bd2144ac0

Comments