MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 554a3dfd96df399b61db1001e97b3b6295ddbbdc76e11e69823127433c92a2e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 554a3dfd96df399b61db1001e97b3b6295ddbbdc76e11e69823127433c92a2e6
SHA3-384 hash: 5f66d819f193f181ce2ae1840ee4fe4ab9d2bdab63a67db02c53795fa6956c82b3376afab53fc7aac3672626ecea1fcd
SHA1 hash: 1e39c0779e39439500a6ee58bc1ae90bff5dac90
MD5 hash: 7e4f5315a0ae2e8886f30c42ec3b5d1c
humanhash: don-hydrogen-south-eleven
File name:PORPOP.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:436'163 bytes
First seen:2020-06-25 08:59:47 UTC
Last seen:2020-06-25 17:48:25 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:ApY2DU3cfgUvtZ7dJXjAQ9FHlMtrVTPSy6p:AQ3c1vtZBJX3LHMNo
TLSH 9694237D29486E392E09611F22B5DC1E2B58FA144CCAC2B385F3CB8D91E9FB41974CD9
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: goldenwesttech.com
Sending IP: 103.99.1.145
From: Mike Kutzle <mdkutzle@goldenwesttech.com>
Subject: update please
Attachment: PORPOP.zip (contains "PORPOP.exe")

AgentTesla SMTP exfil server:
smtp.israelagroconsultant.com:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.44022.26029.17820.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/554a3dfd96df399b61db1001e97b3b6295ddbbdc76e11e69823127433c92a2e6/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kvfd37mw344zwyo3caa6s6z3mkk53o64o3qr42mcgetugpesulta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 554a3dfd96df399b61db1001e97b3b6295ddbbdc76e11e69823127433c92a2e6

(this sample)

AgentTesla

Executable exe 6d74007e7ac24c71ab27dd72dcbf6cc0a7caf046ca1f55eeeacf1e17f73b9d99

  
Dropping
MD5 e4f5fa9448aa0d4bab63566ae4162e56
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6d74007e7ac24c71ab27dd72dcbf6cc0a7caf046ca1f55eeeacf1e17f73b9d99

Comments