MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f84d5ae4feca97952cc596c2b97be8ae94487786220a4bb48645d82c31ff4f00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f84d5ae4feca97952cc596c2b97be8ae94487786220a4bb48645d82c31ff4f00
SHA3-384 hash: a66af93f6a2c4993cefa0f0ed412be7c5a6d827a856d89ed31f7a48234db05da0c61f4a59fbbdcb10e267deb57ddf7e9
SHA1 hash: 1465143ea5a85cdb9d57532f61c2629be2ed4916
MD5 hash: 9a75c0b4a31f20b333d90f971b264062
humanhash: eleven-echo-wyoming-queen
File name:PO000170.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:473'115 bytes
First seen:2020-05-07 06:46:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:MD9s3gdjOaC7anpmlP03eZIrEkvIjeZo4r8bZcYMjD:M5QgdNCGnpqwe8vNZohZVUD
TLSH 48A423C1533105F001DE98F9065FB966C976E48F83372981F7A98777B021EB552AAC1E
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ritmapres.com
Sending IP: 103.125.190.223
From: ff.ong@ritmapres.com
Subject: New Purchase Order For May 2020
Attachment: PO000170.zip (contains "PO000170.exe")

AgentTesla SMTP exfil server:
mail.tolipgoldenplaza.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic-S.6870.5310.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 07:36:58 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
21 of 48 (43.75%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7bgvvzh6zklzklgfs3bls67iv2keq54geifexnegixmcymp7j4aa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip f84d5ae4feca97952cc596c2b97be8ae94487786220a4bb48645d82c31ff4f00

(this sample)

AgentTesla

Executable exe cd301ca1c374c26aca9bf5381a3b491ae384f06868617c6c16b563213854d159

  
Dropping
MD5 080cfd17bd94ff40a8813cd7c8d03b67
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cd301ca1c374c26aca9bf5381a3b491ae384f06868617c6c16b563213854d159

Comments