MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9921933b3ba01b5463fcbae1c81aa1e5acf96673705f766af797e89d58f52ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9921933b3ba01b5463fcbae1c81aa1e5acf96673705f766af797e89d58f52ec
SHA3-384 hash: 1110a171d9228a03dc34226b6ab5fa50cf8ebc31f3c8fb387ac5fcfc0c13347c6519064ad90ea57a6f2988aaf631468a
SHA1 hash: ad290d6c667caf3f4921b54a51b21dadad4e3e73
MD5 hash: 8ef3bcaf9712880ffdedc4e87ddf1c8a
humanhash: vermont-double-sink-sierra
File name:Purchase order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'065'455 bytes
First seen:2020-06-02 07:40:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:OBVvg5BZkzSm+5d3NHlJ0fuvcqSusU5hrYrR5JzkAuCk2qi5rtsmUSN5oQM1c:OBCP6SHv3NHcixhrYtzkAuCz5rG+5ohc
TLSH 02353377756B641D565B9BBE80C438CBFC347B5220EEF628B23BD24F05263C58862762
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pdlc34160.ciberserver.com
Sending IP: 176.221.34.160
From: Parkhill Patrick E <patrick.parkhill@Meritor.com>
Subject: New purchase order for june
Attachment: Purchase order.zip (contains "Purchase order.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27681.XorExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21422.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 12:44:53 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
29 of 48 (60.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5gjbsm5txia3krr7zoxbzankdznm7fthg4c7ozvppf7itvmpklwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e9921933b3ba01b5463fcbae1c81aa1e5acf96673705f766af797e89d58f52ec

(this sample)

AgentTesla

Executable exe 8efa5e8db185fb62c1a2156d79988c47d240abf1099e10cefc16a2d3956cb49c

  
Dropping
MD5 5b92589f43966f1326dda013f6f427ba
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8efa5e8db185fb62c1a2156d79988c47d240abf1099e10cefc16a2d3956cb49c

Comments