MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 647e4f8f25356102e3d456aeb52961904ddf507e2377213be643e68492143a8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 647e4f8f25356102e3d456aeb52961904ddf507e2377213be643e68492143a8d
SHA3-384 hash: 0e6eeb4380e6da8005d87d8cc38b7b6342a16f6c95ab3dc81026d91f639d2bc750a86d158b5e0bcf7c321db841766445
SHA1 hash: 397d954529e0fc16e150cc9f9b9499b287cb2af8
MD5 hash: 8b3d6e531cedd4df6a5dce719b95d7d6
humanhash: oven-ohio-west-winner
File name:ORDER-RFQ OM-4670.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:410'447 bytes
First seen:2020-10-25 17:14:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:hizZqPhWP+DF1ALc+u6V4HGeB7R58ogSlAGfYU84oytBXwxk5kdSi9L15CgXxO5b:WZvq+TV4Hd58oGGgYBAxy8+gXsp
TLSH 2A9423593E47CB4370334F88C2512F612046CAD3FB65DB56BDEA6B80942B95634F2EB4
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: akdenizmarine.com
Sending IP: 185.222.58.113
From: Jenny erbil <info@akdenizmarine.com>
Subject: RE: RFQ OM-4670 URGENT
Attachment: ORDER-RFQ OM-4670.zip (contains "ORDER-RFQ OM-4670.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/647e4f8f25356102e3d456aeb52961904ddf507e2377213be643e68492143a8d/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-25 16:05:42 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mr7e7dzfgvqqfy6uk2xlkklbsbg56ud6en3sco7giptijequhkgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/647e4f8f25356102e3d456aeb52961904ddf507e2377213be643e68492143a8d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 647e4f8f25356102e3d456aeb52961904ddf507e2377213be643e68492143a8d

(this sample)

AgentTesla

Executable exe 2e84cd737632fd14d2ac7bb2ad2fb04e79ddd8c35aa6ef397a52f4c139d1c9fb

  
Dropping
MD5 84103a363e3519053a019fcbfb49b496
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2e84cd737632fd14d2ac7bb2ad2fb04e79ddd8c35aa6ef397a52f4c139d1c9fb

Comments