MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f282b99dfbccdf631194f38ff4ba62bb9b79d3174a3c4ea6b08f2012110e4ba4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f282b99dfbccdf631194f38ff4ba62bb9b79d3174a3c4ea6b08f2012110e4ba4
SHA3-384 hash: 760fc581e5a3d6b9936c02eaa8a869951b94459fdc1adb2e90f5f661f618824ace9c46b7f7b1091ea6c7c4788d2ff482
SHA1 hash: 98e0e20334621ed73012db099d3d8690a527280d
MD5 hash: 0d7392b601ea9c6eae39428b1dd0a32d
humanhash: three-jupiter-red-yellow
File name:PURCHASE ORDER.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:249'096 bytes
First seen:2020-05-12 08:51:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:eKIUOTkAio3b+iWt1lnhSXp+iyk/YppgpRy7H3:zLO7Wt1QIkOK3yr
TLSH 3B34233DB183A7125395EEB77F3630821A56EC8DABDD32F2E2CD425D35E46094330A95
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: box.artkartel.xyz
Sending IP: 64.227.121.239
From: Purchase David H Atkinson <mustafa@csrglobal.in>
Subject: RE:Quotation
Attachment: PURCHASE ORDER.zip (contains "PURCHASE ORDER.exe")

AgentTesla SMTP exfil server:
mail.wasstech.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22360.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 22:53:02 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6kblthp3ztpwgemu6oh7jotcxonxtuyxji6e5jvqr4qbeeiojosa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f282b99dfbccdf631194f38ff4ba62bb9b79d3174a3c4ea6b08f2012110e4ba4

(this sample)

AgentTesla

Executable exe 6e1b968192bdf51820df2d4c83f322000331ecbf6a1f5e6c91301d2bfdf47637

  
Dropping
MD5 7fef57af049ab9441f9d219f180c2216
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6e1b968192bdf51820df2d4c83f322000331ecbf6a1f5e6c91301d2bfdf47637

Comments