MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06b1441efdb02e5d77466c0b6ee669b6f2ad9ba0d89f26ad04daf6acd10bd3db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06b1441efdb02e5d77466c0b6ee669b6f2ad9ba0d89f26ad04daf6acd10bd3db
SHA3-384 hash: a08493dfb728eecbc9b347b11a8d086df6b23ba89cb6df38496ab0aeee5abac7543e8218f7a7ece8a00cf101dad3be61
SHA1 hash: b4e930fb762e08498be963f66c6d024361ce2552
MD5 hash: ad788b821e85f0f78608ff87f5a2a747
humanhash: stairway-alabama-oscar-green
File name:Purchase Order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:800'058 bytes
First seen:2020-05-11 07:59:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:c6P5oZFsfemBMJT/1HP4d7PwJMGlncJTB/F2ilb9XmvlU/88I3oUzXVQ31YT5k:jOommkVK7P1JllR0U/8BXVQ31YS
TLSH 180523E6011EC11A76389765F8BE557D0E38BD8F043BB8A461FD252F0850EC9EE527E2
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: premium37-1.web-hosting.com
Sending IP: 198.54.114.243
From: bunmi.oyemade@efficacyconstruction.com
Subject: PURCHASE ORDER
Attachment: Purchase Order.zip (contains "Purchase Order#0398483.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 13:59:47 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a2yuihx5waxf252gnqfw5ztjw3zk3g5a3cpsnlie3l3kzuil2pnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 06b1441efdb02e5d77466c0b6ee669b6f2ad9ba0d89f26ad04daf6acd10bd3db

(this sample)

AgentTesla

Executable exe 40eac0b9c7fb03c9f4a54a82b47534babfdcc931b5d83832f1ae2facd9fe0cc3

  
Dropping
MD5 53e410760c9f2f2c4a1144fc34eb455a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 40eac0b9c7fb03c9f4a54a82b47534babfdcc931b5d83832f1ae2facd9fe0cc3

Comments