MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e6a39646f311469197662da1a1ae54d3e964c21274332b235cd9df9c44eb654. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e6a39646f311469197662da1a1ae54d3e964c21274332b235cd9df9c44eb654
SHA3-384 hash: 5849207c1e6a98d6c81f82d43e9d671a64e611da08e2ee0fb202ee0f5890d386ba1e636607b1f4f87973165c95e7dbfa
SHA1 hash: d0fa5123e9d596f5749a83ee20136bc237682acc
MD5 hash: d30e3c040cf8bc2cb2f741307ec8c902
humanhash: colorado-magazine-carolina-white
File name:Purchase Order.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:465'139 bytes
First seen:2020-07-29 05:19:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:RS1dLsL24VRIwYHXBrrv9EGeI+8iOOEIwd/fU1iUmtCpGWXj3wR:RS1qL24V+X3l9vjiqxfUlmtCpGWzg
TLSH B7A423C78DBC1D3701647A63CE27E3132BAE1E8F6E92879DBCB1A678259E0F03054156
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: relay.mailexchanger.co
Sending IP: 66.23.229.199
From: smtp@lahoreoilstore.com
Subject: Payment Slip $40,580 & PO
Attachment: Purchase Order.z (contains "Purchase Order.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.20845.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e6a39646f311469197662da1a1ae54d3e964c21274332b235cd9df9c44eb654/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 05:21:08 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hzvdszdpgekgsglwmlnbugxfju7jmtbbe5btfmrvzwo7trcowzka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/3e6a39646f311469197662da1a1ae54d3e964c21274332b235cd9df9c44eb654

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 3e6a39646f311469197662da1a1ae54d3e964c21274332b235cd9df9c44eb654

(this sample)

AgentTesla

Executable exe bf47e9687dd959333232b5a0c139edcb06478f59da4769ace1211c1ce06dc7b1

  
Dropping
MD5 26444ee092b0be647c9d16f7f6c54996
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bf47e9687dd959333232b5a0c139edcb06478f59da4769ace1211c1ce06dc7b1

Comments