MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a286ac4f3ab4c2a3074ca9f97832951018767ea756f6dec3438cdd85b775fc0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a286ac4f3ab4c2a3074ca9f97832951018767ea756f6dec3438cdd85b775fc0
SHA3-384 hash: ff4e077f0bc4b3c088cdff14a5ab04e6f8b92bca827d247bbe8bc26c8b0a94250474a1fa25c283dcf9e6d3797cfde14b
SHA1 hash: 9708761c7273c74553d4d78c5dd80a3385e7529e
MD5 hash: 76c6135cca02afbd25b4aae97cd6a62c
humanhash: delta-louisiana-mockingbird-oxygen
File name:OUTSTANDING INVOICES.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:729'659 bytes
First seen:2020-08-04 07:44:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:xDSR1f8m1UJoRDzEv9E270jjor0x+dSYCyezYC+AHA2kGKR4WhO5pli+eLYFSc21:pSR1f8m1USRkVf4jjU0wdoN8GHA2kV4g
TLSH 74F423A293B7510FAE3CA112912066177878BADC90873DEA5404CDBD687258ADCCFF7D
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: nittsu.com
Sending IP: 103.133.104.130
From: SGN AirImport <sgnairimport@nittsu.com>
Reply-To: sgnairimport@nittsu.com
Subject: (A/C: 310053) -Outstanding invoices
Attachment: OUTSTANDING INVOICES.zip (contains "OUTSTANDING INVOICES.exe")

AgentTesla SMTP exfil server:
mail.pkfpmes.co.ke:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisD9A00517ACE8.4232.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a286ac4f3ab4c2a3074ca9f97832951018767ea756f6dec3438cdd85b775fc0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 07:46:07 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=riugvrhtvngcumduzkpzpazjkeayoz7kovxw33buhdg5qw3xl7aa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8a286ac4f3ab4c2a3074ca9f97832951018767ea756f6dec3438cdd85b775fc0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 8a286ac4f3ab4c2a3074ca9f97832951018767ea756f6dec3438cdd85b775fc0

(this sample)

AgentTesla

Executable exe d76e8c28bcd9120d10cb82a86e5ab7679cc78f44f6edf644608b9fddeb7e8cbc

  
Dropping
MD5 d9a00517ace8e5badb2212cb327b27e1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d76e8c28bcd9120d10cb82a86e5ab7679cc78f44f6edf644608b9fddeb7e8cbc

Comments