MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d20bae48c7ffdc3f91ff18f9ea2fceb119290ddd4824a3ccd15b0d991ad632f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 4 Yara Comments

SHA256 hash: 8d20bae48c7ffdc3f91ff18f9ea2fceb119290ddd4824a3ccd15b0d991ad632f
SHA1 hash: b8b778f9ed7e93c2b3ddeb364747c1bf578da758
MD5 hash: f5c198b180bcece77f9e857e332d3851
File name:Purchase Order MG-PO-15719.rar
Download: download sample
Signature AgentTesla
File size:394'407 bytes
First seen:2020-05-22 10:05:40 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Qv7W7fzu+OS3o8GGp97F/ikw2wGXruHUK6IUChUov+/f2OuiCUPDcA2iKVc0:Qafzu+KXGp3/EZIy0Iv+X2OFCADcTL
TLSH 9784230A1EB247FEF6F058448FC1880B518A17FECB383C749A5D84D48A9BA5753E07B6
Reporter @abuse_ch
Tags:AgentTesla rar


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: kore.dnskore.com
Sending IP: 195.22.8.68
From: Ahmed Hamsa <info@zahrawigroup.com>
Subject: Revised P O
Attachment: Purchase Order MG-PO-15719.rar (contains "OGh90TJnFCLq82I.exe")

AgentTesla SMTP exfil server:
smtp.almahidtechtop.top:587

Intelligence


Mail intelligence
Trap location Impact
Global Medium
# of uploads 1
# of downloads 22
Origin country US US
ClamAV No detection
VirusTotal:Virustotal results 13.11%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 8d20bae48c7ffdc3f91ff18f9ea2fceb119290ddd4824a3ccd15b0d991ad632f

(this sample)

  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment

Comments