MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3788ee172b8651f14e8e62cd7216fa9f70f4b3545222655fedb07f5b23b18e7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3788ee172b8651f14e8e62cd7216fa9f70f4b3545222655fedb07f5b23b18e7f
SHA3-384 hash: 369cc056c28d41c9c6f90e08636dd40b62ed30a12bf15fcf10db874e43f38511bd8c38ae2ab1f8a49ab50f1c8d310029
SHA1 hash: bcc318830416118527cc3a29360e75e1ef8ab0a9
MD5 hash: bc0525eeaa649306a8b79de5c760fb68
humanhash: football-jupiter-cold-bravo
File name:Purchase Order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:417'714 bytes
First seen:2020-06-15 14:13:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:OcTa9CREwR9cDJZi5jpYySn2Q22ddXEQo0ljym:Ra/E9cDJZEpvfQR
TLSH 159423EF85D27213EAE8E0A13C5A1D4D0A69D1F4135D39096FE2D943C3130D9EDE19EA
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: b47.baggieshost.com
Sending IP: 162.144.151.74
From: Rahbari Mehdi <rishabbh.bhogra@corpseed.com>
Reply-To: umit@isbnkasi.com
Subject: Purchase Order
Attachment: Purchase Order.zip (contains "Purchase Order.exe")

AgentTesla SMTP exfil server:
mail.samudrapanel.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.20845.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Ludicrouz
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 14:15:06 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g6eo4fzlqzi7ctuomlgxefx2t5ypjm2ukirgkx7nwb7vwi5rrz7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3788ee172b8651f14e8e62cd7216fa9f70f4b3545222655fedb07f5b23b18e7f

(this sample)

AgentTesla

Executable exe 2ff509b5c75381343d7580089cf26cffde2d92084e171753685575d63fdf0009

  
Dropping
MD5 60bf6075a9dd4e6833ef1c3874900384
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2ff509b5c75381343d7580089cf26cffde2d92084e171753685575d63fdf0009

Comments