MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6d985c984742eaef4baa9647cb3de87a5de7e2f3a33e63d255a29d1bedf2b46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6d985c984742eaef4baa9647cb3de87a5de7e2f3a33e63d255a29d1bedf2b46
SHA3-384 hash: f548dd41d0c300bf7bba9959445e1d0010e94d829fb9e9555d71c6570cd11203def924845c384114ac77f932ef829059
SHA1 hash: af2571ba0e6b9afabae02c44690ed9c7447e18eb
MD5 hash: 3a63a5e9ef5caa805c9bcfef5213618e
humanhash: fifteen-beryllium-wisconsin-minnesota
File name:Purchase Order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:434'589 bytes
First seen:2020-05-04 20:51:34 UTC
Last seen:2020-05-07 11:26:03 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:fo9tj4T77axdke/5G3s27hDsHU7UxREuvvHGDd5K7:g/adhogOaunmDP8
TLSH 0694231B65B1641F05878D49EEFA6E212484C9D30C1BFBE4B1FE32A4DE4D62757AB009
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: fluidrame.com
Sending IP: 103.145.253.9
From: Albayader <nmascarenhas@fluidrame.com>
Subject: RE:RE: REQUEST FOR QUOTATION
Attachment: Purchase Order.zip (contains "POLwtksTxCFgqh7.exe")

AgentTesla SMTP exfil server:
mail.islandkingpools.com:587

Intelligence

File Origin
# of uploads :
4
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.48323.16686.26745.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 18:29:07 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u3mylsmeoqxk55f2vfshzm66q6s547rphiz6mpjfliu5dpw7fnda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip a6d985c984742eaef4baa9647cb3de87a5de7e2f3a33e63d255a29d1bedf2b46

(this sample)

AgentTesla

Executable exe a563a898ce1c8dcac374ef8a468e39a185ca3b010f1a41b60731a7beac23f846

  
Dropping
MD5 5d272c686eeb536b59cc1e899e47c07b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a563a898ce1c8dcac374ef8a468e39a185ca3b010f1a41b60731a7beac23f846

Comments