MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2181d811321776e8f4ba5f1cce5aba8db5c848ae5db00372071b5547a2ffd284. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2181d811321776e8f4ba5f1cce5aba8db5c848ae5db00372071b5547a2ffd284
SHA3-384 hash: a8c71c2c421257dab1fc96f661d7c53f9f72c92f5c21d1fcc7cb1b2294b64ffde9214fd146882970764037369a6d008a
SHA1 hash: d6033ba2f1c5a8703ce5f96c7ca1d4c11d0095a3
MD5 hash: c62fd4710dae4478bb8b6851e21ede96
humanhash: spring-pennsylvania-april-angel
File name:Po0923845.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:530'799 bytes
First seen:2020-08-06 08:02:18 UTC
Last seen:2020-08-08 12:56:03 UTC
File type: z
MIME type:application/x-rar
ssdeep 12288:cj5jNLiNcXl9NXQ58JsEcNRxBE8xXOByvNEOdH7IW7:a5jNLiNOrg58JPcNRnFxG+tt7IW7
TLSH A4B4232CF6E7441CF6316960672A1CF5E8186CAA54948414E7BFC2B90F84D5ECABCF27
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: drevovyrobakamenicky.sk
Sending IP: 45.137.22.94
From: Procurement Officer<info@drevovyrobakamenicky.sk>
Subject: Fw: Purchase Order -73891
Attachment: Po0923845.z (contains "Po0923845.exe")

Intelligence

File Origin
# of uploads :
24
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2181d811321776e8f4ba5f1cce5aba8db5c848ae5db00372071b5547a2ffd284/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 08:04:12 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ega5qejsc53or5f2l4om4wv2rw24qsfolwyag4qhdnkupix72kca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2181d811321776e8f4ba5f1cce5aba8db5c848ae5db00372071b5547a2ffd284

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 2181d811321776e8f4ba5f1cce5aba8db5c848ae5db00372071b5547a2ffd284

(this sample)

AgentTesla

Executable exe c384329760d0131d7421eda97a27136a3cee9271d4645a64e7248ae709150a4e

  
Dropping
MD5 27e7069b4e94b2b6068adad632d96781
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c384329760d0131d7421eda97a27136a3cee9271d4645a64e7248ae709150a4e

Comments