MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a86c386127d0274355a34ef9e6cb1cc5b513a036c777e9b45ee3364e01129b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a86c386127d0274355a34ef9e6cb1cc5b513a036c777e9b45ee3364e01129b7
SHA3-384 hash: 5fb2834bd3ca0dcd2e16676ec4b1e5c14bb3dee6e027b08531275bfe7bb9941780ac50acdcb959ea42c6d1d11af7dcf7
SHA1 hash: 33799d32f805ac9664e0b3f86b34fed6c716f86a
MD5 hash: f1cf0fa6ad2a1ca6294a9d09fd036b27
humanhash: spaghetti-eight-sodium-moon
File name:PI for requested order pdf.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:911'814 bytes
First seen:2020-06-02 07:47:15 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:/MlFrU763Kk7Vq1BoQWIi+ucerL1QXql+l8YZEPjDX63fkiVyNFLQWv0+lzerq1P:8ou3RiK57V26l+l8jvK3rqx5JadoSdQz
TLSH 1B1523F1FAF58C7A3A722E3D0E9463B04A1F760418B045A6326F7DB7CE909D621119DE
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ankost.com
Sending IP: 45.153.240.97
From: IPAREDES<lparedes@ankost.com>
Subject: ARRANGE PI FOR MAY ORDER
Attachment: PI for requested order pdf.zip (contains "PI for requested order pdf.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 08:36:24 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bkdmhbqspubhink2gtxz43frzrnvcoqdnr3x5g2f5yzwjyarfg3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 0a86c386127d0274355a34ef9e6cb1cc5b513a036c777e9b45ee3364e01129b7

(this sample)

AgentTesla

Executable exe 6b28cef94075f6c39522b87d945eb0f895387e217a6cd7f6f3e260eef60f32f6

  
Dropping
MD5 47e2e13fff82210841602e2c3691b1ed
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6b28cef94075f6c39522b87d945eb0f895387e217a6cd7f6f3e260eef60f32f6

Comments