MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfd41e4b88ac436519ca9ef6307883a791f53398e217d90844cb36e9c6c49a74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bfd41e4b88ac436519ca9ef6307883a791f53398e217d90844cb36e9c6c49a74
SHA3-384 hash: e53227290a51ae5bc65a6edfdf4d7f5465e19b0fe7afe8b1d98cbd196e1370e57d223ca45927d0a08c88901a3b9fa317
SHA1 hash: 19e9f5f02573abf827698e74231d390d42d7b73e
MD5 hash: f1b990ac2e8401be8f1c071579839b4a
humanhash: eighteen-sweet-venus-romeo
File name:ORDER48543XC328-ORDER4856CC38219-pdf.7z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'012'988 bytes
First seen:2020-06-04 06:28:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:/rYUwSW2lmQI0wbV801o6eh2zlfRPYSymIWP0mv:/rYwWYI9m0zwSAov
TLSH 86253356AB9C527C8791CC6CD8AC815F4C68B0F90133AB3059D199223F3B2DD8F7896A
Reporter abuse_ch
Tags:7z AgentTesla


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: chdinformatica.servidorplesk.com
Sending IP: 91.142.217.106
From: Coelho Carlos <Carlos.Coelho@jungheinrich.pt>
Reply-To: Coelho Carlos <dustiutd12@hotmail.com>
Subject: Fwd:Order From Specific Customers
Attachment: ORDER48543XC328-ORDER4856CC38219-pdf.7z (contains "ORDER#48543XC328-ORDER#4856CC38219-pdf.exe")

AgentTesla FTP exfil server:
ftp.kassohome.com.tr:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25906.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 06:37:53 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x7kb4s4ivrbwkgokt33da6edu6i7km4y4il5sccezm3otrwetj2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip bfd41e4b88ac436519ca9ef6307883a791f53398e217d90844cb36e9c6c49a74

(this sample)

AgentTesla

Executable exe 47dcc6c1ba8befde8b00bb29af4233cc75f4dbcd3bec83b4b1bdbc06a25fbe6c

  
Dropping
MD5 26e58bd701aa089d64eddaa6179d3b7b
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 47dcc6c1ba8befde8b00bb29af4233cc75f4dbcd3bec83b4b1bdbc06a25fbe6c

Comments