MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf45d1ca55bca99243a2cb3a13f6dbd22a44b940e75fd83f1e8fa163cadc6bbe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf45d1ca55bca99243a2cb3a13f6dbd22a44b940e75fd83f1e8fa163cadc6bbe
SHA3-384 hash: 4dc3ede76172e9e8a9095b1a4c0ae309922064c1352533bf5eca9296d65099d586bb9bffaf8f7e84795de608fede4883
SHA1 hash: 718204c0ef2fd79d93a3fea576d50b24c47a07b5
MD5 hash: e1a158d698abac0978f1df7fe1cce9b1
humanhash: diet-yankee-six-mockingbird
File name:order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:461'469 bytes
First seen:2020-05-25 07:48:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:mzSydyZfFRZZnBGGonsJpSwrLraMuuxCQ1nM:AWRZxCsDSwrLr7u2CQ1nM
TLSH E2A423AF883A34A8378F7589302891FC5298739655CD6ACB780DC7F44ECE847995F50B
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: servers.com
Sending IP: 185.234.216.155
From: Michael Black<secureserver@servers.com>
Subject: NEW ORDER PRODUCT NEEDED
Attachment: order.zip (contains "wzzy crypt.exe")

AgentTesla SMTP exfil server:
mail.totallyanonymous.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 04:22:25 UTC
File Type:
Binary (Archive)
Extracted files:
317
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip bf45d1ca55bca99243a2cb3a13f6dbd22a44b940e75fd83f1e8fa163cadc6bbe

(this sample)

AgentTesla

Executable exe 3648e21e80655e2b860743f4d3c113d019b579230ebf579fbe8f49316e3e8427

  
Dropping
MD5 e6f080cffd71d8c215c1a81d6237318c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3648e21e80655e2b860743f4d3c113d019b579230ebf579fbe8f49316e3e8427

Comments