MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a97746de06a54d234ea172e8cd42d8caa5a45fa9e75161af73c546b7d063413. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a97746de06a54d234ea172e8cd42d8caa5a45fa9e75161af73c546b7d063413
SHA3-384 hash: 7f1d5f8f544e4e668df603ed12d61c273eb8cd331c2ad0576f7434898d6637d2f1bee2d30455840061ec8d1cf9844931
SHA1 hash: 9461151b9e369a1f0eae42dbe0b3ac9745e7d7b1
MD5 hash: 12756f1f52ddbdc1baaba2cdc3593c88
humanhash: oscar-california-oscar-oscar
File name:ORDER...08312020.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:878'539 bytes
First seen:2020-08-31 11:26:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:3inmSUFfNiULMY2xtHI/hssUkYqgvbXZQ7XJ+TPTF:3inmRNiUIbxqrg87cTbF
TLSH 371533D417DAD2B74340788AC8966EAAD0DA46E0E0BCD4176DABFEF5132145CE03547E
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: kanri.anchor-net.jp
Sending IP: 172.105.195.174
From: 영업 관리자<layla@isu.co.kr>
Reply-To: sales1@abrablast.co.kr
Subject: 포장 목록EXP-3173
Attachment: ORDER...08312020.zip (contains "ORDER...08312020.exe")

AgentTesla SMTP exfil server:
mail.cka.com.sg:587

AgentTesla SMTP exfil email address:
agnes@cka.com.sg

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisBE362BCC6B73.30503.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a97746de06a54d234ea172e8cd42d8caa5a45fa9e75161af73c546b7d063413/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-31 03:25:16 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fklxi3panjknenhkc4xizvbnrsvfurp2tz2rmgxxhrkgw7iggqjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2a97746de06a54d234ea172e8cd42d8caa5a45fa9e75161af73c546b7d063413

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2a97746de06a54d234ea172e8cd42d8caa5a45fa9e75161af73c546b7d063413

(this sample)

AgentTesla

Executable exe 23f83ce99c97dfbbd5fe5201cde2b22d9673ed6680fb99997adc6208fbf2065f

  
Dropping
MD5 be362bcc6b73b3447bb61a2e18dae0e8
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 23f83ce99c97dfbbd5fe5201cde2b22d9673ed6680fb99997adc6208fbf2065f

Comments