MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19e8a47849ce9ddb18a3f03f6358bb17dd2aaf873eaf8aca88b94c3dd00265dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19e8a47849ce9ddb18a3f03f6358bb17dd2aaf873eaf8aca88b94c3dd00265dd
SHA3-384 hash: 4e1b4f673a405b749e90f7976e3b1e359015c00363c76a77368ec4565e49b89f5463c7bfb51a9bab730d8a5e4aba454c
SHA1 hash: 705b5d2239711850d070c7e3b3328088c642b4bf
MD5 hash: 7968603f73e581c7db6d369c6aff2893
humanhash: vermont-twenty-autumn-colorado
File name:PO.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:513'916 bytes
First seen:2020-05-11 09:25:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:dfRMbl+slcPtKdbZeqfSEXEj6y/MTS9iRV7cGLOK/1na:FHP2eqfS8NyeSmV7cGLk
TLSH 9FB423FB63993878BC3214B85515149CCCB0EBAB7EB3E23831A96D645EF77A4C748601
Reporter abuse_ch
Tags:AgentTesla Yahoo zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic311-15.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.131.125
From: Info <morris.shaw84@yahoo.com>
Reply-To: morris.shaw84@yahoo.com
Subject: RE:Revised offer
Attachment: PO.zip (contains "HPDE_INQUIRY_11052020.exe")

AgentTesla SMTP exfil server:
smtp.zoho.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Artemis85EBAC484AE7.32433.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 09:36:20 UTC
File Type:
Binary (Archive)
Extracted files:
404
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dhuki6cjz2o5wgfd6a7wgwf3c7osvl4hh2xyvsuixfgd3uacmxoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 19e8a47849ce9ddb18a3f03f6358bb17dd2aaf873eaf8aca88b94c3dd00265dd

(this sample)

AgentTesla

Executable exe 80eb41c227d25497e75d5d5bde1e26d917d997c5a7dabdcc31c31ae1008a7ced

  
Dropping
MD5 f715f9c3bbcd89ce5293cf694d5e2b29
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 80eb41c227d25497e75d5d5bde1e26d917d997c5a7dabdcc31c31ae1008a7ced

Comments