MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56283daa993c54917a979be47f1d2da7f27abb64a201d47ef47740967110632a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56283daa993c54917a979be47f1d2da7f27abb64a201d47ef47740967110632a
SHA3-384 hash: bc1a7b4cb6682cfb0dc142570cbe5eba3f7e754f2b08a4c3a27484a1b1d97bda63e6bfa65cb713e00952926ba263f24f
SHA1 hash: 10585a31b877ca7be6e8efbdd4e2eb3a4fcb17de
MD5 hash: 0ed4a5828f5dabbc6441d66a46aad53e
humanhash: michigan-lion-hot-louisiana
File name:RE,NEW PURCHASEING ORDER.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:452'371 bytes
First seen:2020-07-29 11:32:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:yL1/gPKhQ93eVUnBvzKpg18Pu/ttyFNsWy0LToay4O:yRaK+36MpzKa14u/Q7TtpO
TLSH 00A4232EE5E36ECD0734445A288F8A1A5C54D58AC41C4CBFFA354875BED7F1D808A3BA
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: buypower.es
Sending IP: 156.96.157.112
From: alicia.gomez@buypower.es
Subject: RE,NEW PURCHASEING ORDER MACHINES
Attachment: RE,NEW PURCHASEING ORDER.zip (contains "RE,NEW PURCHASEING ORDER.exe")

AgentTesla SMTP exfil server:
mail.cjcurrent.com:26

AgentTesla SMTP exfil email address:
info2@cjcurrent.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Stealer.19347.10936.15784.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/56283daa993c54917a979be47f1d2da7f27abb64a201d47ef47740967110632a/
Threat name:
Win32.Trojan.DataStealer
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 11:34:06 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kyud3kuzhrkjc6uxtpsh6hjnu7zhvo3euia5i7xuo5ajm4iqmmva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/56283daa993c54917a979be47f1d2da7f27abb64a201d47ef47740967110632a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 56283daa993c54917a979be47f1d2da7f27abb64a201d47ef47740967110632a

(this sample)

AgentTesla

Executable exe 31198541765ce3c6e0681658d68a3a6ea70a99f484e05bce3e77f57ed55171c7

  
Dropping
MD5 196618ad0d6494a299207d0a006e04a2
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 31198541765ce3c6e0681658d68a3a6ea70a99f484e05bce3e77f57ed55171c7

Comments