MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f21b73e42b81beefc856c991580bc1e82952790a30bc3b8de9560db2f20e720f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f21b73e42b81beefc856c991580bc1e82952790a30bc3b8de9560db2f20e720f
SHA3-384 hash: 5e0a6375045a3c7680f376eda2c2ebb9d942cac51dc40952dc0d94e74535b2d78abb3549929e2cd5c732046f4f4ce229
SHA1 hash: 4465880d2f2f1960625fdcdcff045995eb5dc26f
MD5 hash: c9ce097f6eccc1f93f97678c82cb2e66
humanhash: maryland-romeo-delta-maine
File name:Paid.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'049'868 bytes
First seen:2020-05-29 05:26:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:ru/b251SxrCwF2WSOOXnSD41qFtA6XpwJtOJT:ruKDSdPz8nSoqFBlJT
TLSH D92533E0A401B5A9A81A47739896E87F3CF6DD23E624110F435BD03DEF8455ABF6E138
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: eurogeste.com
Sending IP: 202.186.143.19
From: comptabilite | EUROGESTE<comptabilite@eurogeste.com>
Subject: Payment done
Attachment: Paid.zip (contains "Paid.exe")

AgentTesla SMTP exfil server:
business40.web-hosting.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27681.XorExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-29 05:36:06 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f21b73e42b81beefc856c991580bc1e82952790a30bc3b8de9560db2f20e720f

(this sample)

AgentTesla

Executable exe e9fc4844ee50f9e59616bd7238bfae3de6b8b194abf635e787e5a44d8658fe42

  
Dropping
MD5 42eb50b9b2cf1c267d43a6ce6cb6c6c6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e9fc4844ee50f9e59616bd7238bfae3de6b8b194abf635e787e5a44d8658fe42

Comments