MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82eb50eb85ff4c5a60754c04da58fcd0c9c406440d5c28529428ccce8eca23f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82eb50eb85ff4c5a60754c04da58fcd0c9c406440d5c28529428ccce8eca23f9
SHA3-384 hash: 5f269941a9c14e59db495a8f27ee515782bbb8b61a3656152e68272f4d93e63902cecb980d575e292bece60501706965
SHA1 hash: 28c22a2c74abd113e9e1ce0d57bb9775734aecd0
MD5 hash: a34d7944abc8fa1d64d1b28ac90d3ecb
humanhash: sad-whiskey-indigo-cardinal
File name:PO5643234576.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:398'933 bytes
First seen:2020-08-04 07:46:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:5gleIDDuVpEKOEZvJIxPf3sTE7E1/K9AG5rBwXMUleOf1ZE8UEXj8:5mpuVSyvJ4PPsTE799AG5rBwX15fTg
TLSH 808423016D5F0FEC937F1966E2114E8F653AACD287B2494943B176E6B0D06FF202BA4D
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: powertr@cyber.net.pk
Subject: AW:Purchase Order
Attachment: PO5643234576.zip (contains "PO74845675.exe")

AgentTesla FTP exfil server:
triathlon-batteries-uk.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82eb50eb85ff4c5a60754c04da58fcd0c9c406440d5c28529428ccce8eca23f9/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 07:48:07 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qlvvb24f75gfuydvjqcnuwh42de4ibsebvocquuufdgm5dwkep4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/82eb50eb85ff4c5a60754c04da58fcd0c9c406440d5c28529428ccce8eca23f9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 82eb50eb85ff4c5a60754c04da58fcd0c9c406440d5c28529428ccce8eca23f9

(this sample)

AgentTesla

Executable exe 097ef15c4b39a5c768934359f140c3f41e9fd8cfc00c32edf54c96ae72417ed0

  
Dropping
MD5 87a8379eafe2d18d2abcd093a2fc8ff5
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 097ef15c4b39a5c768934359f140c3f41e9fd8cfc00c32edf54c96ae72417ed0

Comments