MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b580f21ea08b1edc472841666eb079a01241a29a53415cf0fa220de47fc1ace. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b580f21ea08b1edc472841666eb079a01241a29a53415cf0fa220de47fc1ace
SHA3-384 hash: 118635e5c7ff226ce34dd0f63e2bd32afe024dba6a6bc4545d4a77ff644e849b18f572c8790d4f4fb404e5da33593d4c
SHA1 hash: 5666feb428719c5f4dff306b912cd66c20f49227
MD5 hash: 97fe10d8448223bc117ef915c5a097a1
humanhash: twenty-don-high-eighteen
File name:XSL New Order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:408'268 bytes
First seen:2020-06-15 12:42:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:EsPQersC+lJz8pgZiHnhpowyLc/WFtLhN3r:4yjpfowyLc4tL7
TLSH DA9423B0FC4CC4E061227A39B56919509BCFF28FD4DA033E988976DC14B756FB98D522
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.leonardfood.com
Sending IP: 87.107.124.150
From: Gisha Forouz <sales@leonardfood.com>
Subject: Re: Purchase Order 16465
Attachment: XSL New Order.zip (contains "XSL New Order.exe")

AgentTesla SMTP exfil server:
mail.leonardfood.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Win32.Sonbokli.Acl.11575.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-06-15 12:44:06 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fnma6ipkbcy63rdsqqlgn2yhtiasigrjuu2bltypuiqn4r74dlha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 2b580f21ea08b1edc472841666eb079a01241a29a53415cf0fa220de47fc1ace

(this sample)

AgentTesla

Executable exe 66e5066b4f068a1001c833a8ac60a91c0bc99f36d79950a6b51438950292df03

  
Dropping
MD5 b28fbe0782ddf73dc9055377aaeec74c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 66e5066b4f068a1001c833a8ac60a91c0bc99f36d79950a6b51438950292df03

Comments