MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e81bb995d339e9acd075dd6281312706f2b4d8f318cc7cf1cebd32dd208e384. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e81bb995d339e9acd075dd6281312706f2b4d8f318cc7cf1cebd32dd208e384
SHA3-384 hash: 1c8b95b7f9ddaf1ca24e7016ce16610e8fbc3a8b2dfdaca958d54b2778fb8ce252938e0e6115ccabd6d348f43348cc3e
SHA1 hash: 728ffa2f62bee4ac7c70bdd594e0498b42a482f6
MD5 hash: 05a786e627c25632ac6fb1ad272bfcfd
humanhash: grey-blue-diet-purple
File name:Purchase order.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:440'764 bytes
First seen:2020-05-27 11:43:07 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:qlCuvF3TBKYpsLduZuTiGWB54DNNEP9kN02PSe4AUvKD:MLeYpAdAsvhNy9PTe4vvKD
TLSH 2594230F69C614CECCA1C5A73FE13EA8C9954ADFFC5BF8794A48115D403892E2BC94A7
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: corry.duckdns.org
Sending IP: 209.182.219.3
From: andre@humeau.com
Subject: Purchase Order
Attachment: Purchase order.z (contains "Purchase order.exe")

AgentTesla SMTP exfil server:
zstcznz.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 12:37:04 UTC
File Type:
Binary (Archive)
Extracted files:
276
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 9e81bb995d339e9acd075dd6281312706f2b4d8f318cc7cf1cebd32dd208e384

(this sample)

AgentTesla

Executable exe 1491dce66c200855205d540f41b7eb7fd827e57bf09b9b90b2ee5470307dc7e0

  
Dropping
MD5 5e03ad0045f1292744939b5c18a0d624
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1491dce66c200855205d540f41b7eb7fd827e57bf09b9b90b2ee5470307dc7e0

Comments