MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08b65490b006f4fc37d5c72b609d67590fa8b13597e89c1708704f0f4a3b2cd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08b65490b006f4fc37d5c72b609d67590fa8b13597e89c1708704f0f4a3b2cd1
SHA3-384 hash: 5cdee4ed4c3b359e02961a42c5c0a409d7d08776788e5866325adef1fc2e49987a20434a08d6df7be0ea71fabc3bd296
SHA1 hash: c1e79b0a1c2ff8b1d73bd2b92dccf9b6b6b5c951
MD5 hash: 94778a0761e55abf2fba5fcc54ba9c0b
humanhash: shade-sodium-sweet-purple
File name:wzzy334.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:480'028 bytes
First seen:2020-05-26 11:15:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:micjxqGlo7BchPbUwjSUDyVsRwaZ9/23f+pbyVp:o3DhjUUD3RwDqbyv
TLSH 76A4238F172295827A2D2402B39CD1DC68ABB72165B707F14C9952B2760CBEC51CEFCB
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: servers.com
Sending IP: 185.234.216.155
From: Michael Black<secureserver@servers.com>
Subject: NEW ORDER PRODUCT NEEDED
Attachment: wzzy334.zip (contains "wzzy334.exe")

AgentTesla SMTP exfil server:
mail.totallyanonymous.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 11:36:45 UTC
File Type:
Binary (Archive)
Extracted files:
296
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 08b65490b006f4fc37d5c72b609d67590fa8b13597e89c1708704f0f4a3b2cd1

(this sample)

AgentTesla

Executable exe 86e5796ae957a22f0b55caae1fee9af102cea6e31fca38e4334a50f0b5e57971

  
Dropping
MD5 d689a22a87237998ab61ccab05a5eab0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 86e5796ae957a22f0b55caae1fee9af102cea6e31fca38e4334a50f0b5e57971

Comments