MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87387aa9e41d2c743c3f5732cf40f2bf0af3a1b5020dce3598fe003bb77575af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87387aa9e41d2c743c3f5732cf40f2bf0af3a1b5020dce3598fe003bb77575af
SHA3-384 hash: dd8a10921b1b3da3435bab59cc510db6f10b57ede774e79e2b988011c9687dad8c2ce4a4baed326d83ed2ac1bd347b2f
SHA1 hash: 399421587f3b0adb24ce2aeb800524a3c15d5731
MD5 hash: a1edb65c1e6a15d3b94add900e46aed4
humanhash: sodium-one-bluebird-finch
File name:fatura BX063508.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'104'862 bytes
First seen:2020-04-30 06:49:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:oNXJl4jPoT5DlXyczSadQoBS3xWYuCzuTjKGIhUc5taTB+7PON9EGaccA:olwPo1DICSsdKWGz0Bc5tOBwXTA
TLSH 1C35337E85B904CB3AD8B4DF9ACC0B89331BB61F0559740631039F9D8E7E69B14E9782
Reporter abuse_ch
Tags:AgentTesla geo PRT zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sh.shapeap.live
Sending IP: 77.242.152.68
From: Filipe Benvindo <filipe.benvindo@misericordiagolega.pt>
Subject: Comprovativos pagamento de fatura
Attachment: fatura BX063508.zip (contains "fatura BX063508.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Script-AutoIt.Trojan.Aitinject
Create hunting rule
Status:
Malicious
First seen:
2020-05-01 04:30:14 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q44hvkpeduwhipb7k4zm6qhsx4fphinvaig44nmy7yadxn3vowxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 87387aa9e41d2c743c3f5732cf40f2bf0af3a1b5020dce3598fe003bb77575af

(this sample)

AgentTesla

Executable exe 95654631036f198ae09278641c978609781eee27cdff60dcfe05ba72b367eee7

  
Dropping
MD5 5204df8f33f980c480a91d03d67f59dd
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 95654631036f198ae09278641c978609781eee27cdff60dcfe05ba72b367eee7

Comments