MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 617dc6f05eaae9d3d8ca50ca6d4158c31a137a3d928036cd34144fb4bab4d449. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 617dc6f05eaae9d3d8ca50ca6d4158c31a137a3d928036cd34144fb4bab4d449
SHA3-384 hash: 8dfee174750a71d6e0011510bbfc4af003524783f4d7ac19c2325edcc1af0588b8c0a263059d836abb0a4e5642057813
SHA1 hash: 933ddd365270fb35c8c3e82b720ac12c222d9e21
MD5 hash: d498d74e05524e24bfc8be12f88bb6a6
humanhash: two-enemy-oregon-fix
File name:Purchase order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'075'512 bytes
First seen:2020-06-08 06:57:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:5pp7DHOVfzeOvLIzkxJ+B7ln6w342GdTunm6M+WrN9s9l:5ppGVfPj+kxE6wo7dTFF+WrD+l
TLSH C5353336D240A7A0CC2A84DDF6E827D9AD99E59D100032A2BF8D5F5D403D8B979D3377
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.edicoes-religiosas.com
Sending IP: 78.46.77.226
From: Anncathrine <anncathrine@divinechocolate.se>
Subject: Purchase inquiry 2020
Attachment: Purchase order.zip (contains "Swift.exe")

AgentTesla SMTP exfil server:
mail.durainteriordesign.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27681.XorExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21516.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.AitInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 06:59:06 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mf64n4c6vlu5hwgkkdfg2qkyymnbg6r5skadntjucrh3jovu2req._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 617dc6f05eaae9d3d8ca50ca6d4158c31a137a3d928036cd34144fb4bab4d449

(this sample)

AgentTesla

Executable exe 8b9c0996b6758d8420a490ef1288e12106b78b983c75ecb23f39c8dd09dcc737

  
Dropping
MD5 70b1eb6f3af0d30d0faf164e30a0abea
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8b9c0996b6758d8420a490ef1288e12106b78b983c75ecb23f39c8dd09dcc737

Comments