MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f510d8c903f78262f15edd2b3c4f1778fb590fedb8d54224da31c6717c9c8f3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f510d8c903f78262f15edd2b3c4f1778fb590fedb8d54224da31c6717c9c8f3a
SHA3-384 hash: e3d9a56c18b02a619c3618ac9748b603d3aa9ebf9e5953920590c1be7dc201448d018cf296fab522948bc50d4e7af718
SHA1 hash: a33365e3d18c1f7fc5b93f7fb1ca82bc6219bece
MD5 hash: 0003f99494e9dc0bdc12bd26c6f754a9
humanhash: timing-finch-football-arkansas
File name:PO.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'314'604 bytes
First seen:2020-07-09 06:30:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:rBSCIdECXhZ8ywxuNYTA4IseEYUi0A7S4Vlj:r4iEhr+QYTx7KQmj
TLSH 0C55332156B00B9A30E7C53DD1A45D7223FB890E4F9E9AF51C760ED7F82E645982BC82
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: [103.140.250.133]
Sending IP: 103.140.250.133
From: Megawin Switchgear Pte. Ltd <megawin.switchgear@outlook.com>
Reply-To: megawin.switchgear@outlook.com
Subject: REQUEST FOR QUOTATION.
Attachment: PO.zip (contains "PO.exe")

AgentTesla SMTP exfil server:
mail.cka.com.sg:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21241.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f510d8c903f78262f15edd2b3c4f1778fb590fedb8d54224da31c6717c9c8f3a/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 01:21:00 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6uinrsid66bgf4k63uvtytyxpd5vsd7nxdkuejg2ghdhc7e4r45a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f510d8c903f78262f15edd2b3c4f1778fb590fedb8d54224da31c6717c9c8f3a

(this sample)

AgentTesla

Executable exe 547e52557b519e2b169e8a9c5932e2d7ce615ea34d54348d5d87033a545b6362

  
Dropping
MD5 a925cd618ba6ead6b73ded89b70e69b7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 547e52557b519e2b169e8a9c5932e2d7ce615ea34d54348d5d87033a545b6362

Comments