MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f55492d0af4896a4c6165234affa1478ba189bb9f1611139875ffeceef3db79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f55492d0af4896a4c6165234affa1478ba189bb9f1611139875ffeceef3db79
SHA3-384 hash: 3bc7587395daeb52ae73057daaa44c9399e6dc8b3c97091d6ac29a44627bf23a67f3470dbc0a1d5544868a6f164eef27
SHA1 hash: 836906adac79a9a2b04264015541bfaeaff03372
MD5 hash: 50036f2e7f778a61130d8afbd71ef61f
humanhash: oklahoma-east-moon-failed
File name:PO NO CO4SD34D.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'322'812 bytes
First seen:2020-05-07 07:10:11 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:Fv6NudOtz0XozPc5L+Bq66seWnMRckLcRGOVa3A9nPDsrBVzJb7u1VpyMgjESwP5:FirtzDDx6seWn+ckLcRGOVMIAVzJQVgq
TLSH 225533F8540583E92CE1921E692BBD3DFA2D18DA195CFA1BA50E060567F70F214FDA23
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.hginfra.com
Sending IP: 103.50.212.77
From: Shanghai Rural Industries <info@thermindo.com>
Subject: PURCHASE ORDER NO CO4SD34D
Attachment: PO NO CO4SD34D.zip (contains "PO NO CO4SD34D.exe")

AgentTesla SMTP exfil server:
mail.kalmeplc.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 07:36:50 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r5kuslik6sewutdbmuruv75bi6f2dcn3t4lbce4yox76z3xt3n4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 8f55492d0af4896a4c6165234affa1478ba189bb9f1611139875ffeceef3db79

(this sample)

AgentTesla

Executable exe 80d919181920c0345af86525738917b0fa953faeea16b689533e43bb8e1cf046

  
Dropping
MD5 ce4b34accc783eb3a2886e43443ec2e4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 80d919181920c0345af86525738917b0fa953faeea16b689533e43bb8e1cf046

Comments