MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86271cf159f544308ca1c4076e91c6818e421640446563dbb86fea3e514dfc7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86271cf159f544308ca1c4076e91c6818e421640446563dbb86fea3e514dfc7d
SHA3-384 hash: 69937028b10154e302f2d3d9fe009bf50b847218eb1a055d579f63cc37284fde6c8c455c9b2513ac95447fa8e787fdd4
SHA1 hash: cd71d7c0ceceddc27745657a8b0c30045fadfac5
MD5 hash: 9935ead253bfee4e0d4ced035422bc67
humanhash: mountain-green-alaska-north
File name:Offer.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'077'434 bytes
First seen:2021-01-18 08:00:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:aPQWgx2b925wx7d/yd10o8na57gagxrWFILfg+V+OUvqG4rSzlS90ri:aPQWooNx7my9m7gccf4OUCsSYi
TLSH 33353394829A3249CF7C7229FA335A381DE5C7265662DE21D0F1267AFE57F3C1093DA0
Reporter abuse_ch
Tags:Telegram zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: frf-ajf.ro
Sending IP: 89.45.174.241
From: CLUB ATLETICO <mark.laurel@tutanota.de>
Subject: RE: OFFER OF PLAYER
Attachment: Offer.zip (contains "Offer.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86271cf159f544308ca1c4076e91c6818e421640446563dbb86fea3e514dfc7d/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-18 08:00:16 UTC
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qytrz4kz6vcdbdfbyqdw5eogqgheefsairswhw5yn7vd4ukn7r6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/86271cf159f544308ca1c4076e91c6818e421640446563dbb86fea3e514dfc7d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 86271cf159f544308ca1c4076e91c6818e421640446563dbb86fea3e514dfc7d

(this sample)

AgentTesla

Executable exe df75e05fcf2ca53ab96a989a800b33574bff0c9d4e8171e2baaaad9358a914bf

  
Dropping
MD5 584fec93c4d3af107c1b364f5090de14
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 df75e05fcf2ca53ab96a989a800b33574bff0c9d4e8171e2baaaad9358a914bf

Comments