MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8da897d330824ddbfb4c60346ed6cfe3714a2a87a70db5ca8a39a80cecf05a9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8da897d330824ddbfb4c60346ed6cfe3714a2a87a70db5ca8a39a80cecf05a9a
SHA3-384 hash: a95398152c8840b72a267be78eaddb84dbafc7ae73998b58895bb0cf7ba3f203e9ac78326116778ed3f4daeda0323f91
SHA1 hash: 0091ababcbe6fcafbe06be5ecd020d1678311950
MD5 hash: 0f9e53656830a79cd8b781d991853760
humanhash: finch-lemon-fifteen-snake
File name:NEW ORDER PO 15.08.20.pdf.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:406'148 bytes
First seen:2020-08-15 17:25:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:HA0sL0ssvjIyRtACr8oOYltZF1K3KgXUvh:fsYssZHACrZOVg
TLSH 2A8423BED668A1DFA0E74B1CC7174F19C1A6452884DC5F328CE85A2C9EB04B71DF6263
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: bitisgroup.vn
Sending IP: 5.226.138.173
From: Ngoc My <ngocmy.ta@bitisgroup.vn>
Subject: NEW ORDER PO 15/08/20
Attachment: NEW ORDER PO 15.08.20.pdf.z (contains "NEW ORDER PO 15.08.20.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.15015.12245.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8da897d330824ddbfb4c60346ed6cfe3714a2a87a70db5ca8a39a80cecf05a9a/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-15 17:27:07 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rwujpuzqqjg5x62mma2g5vwp4nyuukuhu4g3lsukhguaz3hqlkna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/8da897d330824ddbfb4c60346ed6cfe3714a2a87a70db5ca8a39a80cecf05a9a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 8da897d330824ddbfb4c60346ed6cfe3714a2a87a70db5ca8a39a80cecf05a9a

(this sample)

AgentTesla

Executable exe bf1016ffb1ecdff1fa7b2b6773ee693cfc6e7e16bdfc467639fe9b60a7c9c668

  
Dropping
MD5 1fad23ed01cbcac7ad8ba778cfff0311
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bf1016ffb1ecdff1fa7b2b6773ee693cfc6e7e16bdfc467639fe9b60a7c9c668

Comments