MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 574fdf028a5265df34e618ee92b9658f213d6f207deb7439b0698266fabf05a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 574fdf028a5265df34e618ee92b9658f213d6f207deb7439b0698266fabf05a7
SHA3-384 hash: d4d12644a81db35b636329773f58392efb8c75fdcdcc9066d7018ba84f32a9d059d5f5f776603287eb1fbe0032a50199
SHA1 hash: 4ea99d1d95140d77097f87cfc349f98cbf9580da
MD5 hash: b541fb77fa3be424250901aa9e45e54c
humanhash: oregon-uncle-mexico-ten
File name:HTQ19-P0401-940 GR2P5 TYPBLDG-NASER AL FERDAN Q0539 NE-Q22.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:616'851 bytes
First seen:2021-03-08 15:08:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:/fmz63RGPAZSxXieeUB8mLSEj3QX5t0E/uI5qdGqgVUkpCxz5tpiNBGdcp8f:/fDwYgxSeea8mLSrv5mddKVXsxjhXf
TLSH 42D423456538185439536A32F6FCD1E2AE8DE483878A3D02F90F7C293749F8AB7605B7
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.kompas.travel
Sending IP: 195.201.103.140
From: Wasif Ahmed <sultan@estscargo.com>
Subject: FW: RE: Samrudh Pharma - Tarapur JASCO HPLC - OUTSTANDING PAYMENT 3/7/2021 10:57:42 p.m.
Attachment: HTQ19-P0401-940 GR2P5 TYPBLDG-NASER AL FERDAN Q0539 NE-Q22.zip (contains "HTQ19-P0401-940 GR2P5 TYPBLDG-NASER AL FERDAN Q0539 NE-Q22.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Bulz.386136.28463.12040.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2021-03-08 10:00:05 UTC
AV detection:
14 of 47 (29.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k5h56aukkjs56nhgddxjfolfr4qt23zapxvxionqngbgn6v7awtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.51
Link:
https://yomi.yoroi.company/submissions/574fdf028a5265df34e618ee92b9658f213d6f207deb7439b0698266fabf05a7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 574fdf028a5265df34e618ee92b9658f213d6f207deb7439b0698266fabf05a7

(this sample)

AgentTesla

Executable exe a26bcb2b12e0321996a511a897e9b5cf677afbe649d6032e1aa1b0da0d128a0d

  
Dropping
MD5 d6d8f310403085dae58d6ba945582955
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a26bcb2b12e0321996a511a897e9b5cf677afbe649d6032e1aa1b0da0d128a0d

Comments