MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 328a6a54b59c45cac9143691b3a5ab83e0fc18b374cd967a8d92ebc935bba2a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 328a6a54b59c45cac9143691b3a5ab83e0fc18b374cd967a8d92ebc935bba2a8
SHA3-384 hash: d8a2f8f8f8825b1d11ad3460b5dfaab7718a632f1c0df81488ccdd56ac20f5f72c37430badae30852ba138af764d1fc4
SHA1 hash: 8a0145e4ad74d84e62aab1437e4c44d18d09baf4
MD5 hash: 46cc2148bd1f507701720a899435908a
humanhash: cardinal-fillet-twelve-river
File name:Ordem de Compra_Ref_6842_82917.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'024'202 bytes
First seen:2020-05-12 16:31:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:3sjLrmo82B+uALk+OKWPzPz9/bSuXOd5aNXH4dPP971:3sfK6BWLQtnJeu+d82PH
TLSH 1A253311E55C6ED8850B8A658335F2ABC93F5F25E3EC285D708E6162C2711E2F4BCB78
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: co.comboserv.live
Sending IP: 45.95.171.143
From: Anabela Carvisouto <info@comboserv.live>
Subject: Ordem de Compra_Ref_6842_82917
Attachment: Ordem de Compra_Ref_6842_82917.zip (contains "Ordem de Compra_Ref_6842_82917.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 16:36:49 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gkfguvfvtrc4vsiug2i3hjnlqpqpygftotgzm6unslv4snn3ukua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 328a6a54b59c45cac9143691b3a5ab83e0fc18b374cd967a8d92ebc935bba2a8

(this sample)

AgentTesla

Executable exe 2929bd7e338ae0270746e4b60faa44c0f5d3d34c4d166964ce013100bafbf1a3

  
Dropping
MD5 86b6b20a62c70f0be4cc5236b45a4fc8
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2929bd7e338ae0270746e4b60faa44c0f5d3d34c4d166964ce013100bafbf1a3

Comments