MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91443023d34f6eacea7ddde507261f746f96014a6a7b0a8dad2fe5dde61a0373. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 91443023d34f6eacea7ddde507261f746f96014a6a7b0a8dad2fe5dde61a0373
SHA3-384 hash: e4ebfd1675c452d44c8279852652a3c178c1fa649b3e0ae57af5780d9c3429c2d7ee579c36632f2d07962f1c7684cec0
SHA1 hash: 1eb66925726075b28ef02eda25775531ec44cbaf
MD5 hash: a01aaea8e86f01619bee415697f432b5
humanhash: neptune-uncle-ceiling-early
File name:Order 01001O02.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:518'331 bytes
First seen:2020-10-24 06:40:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:maSBmmeMWKgR3St9kceoGBkECdAT7s+r70bLOx4J77j:mFBnWKcSMsxNSM+EP44p3
TLSH C5B4236E12128C1DB3987BABE1ED433368F4A94C15F71704D100E36ADD9464DE8E6AF7
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: blancmariclo.com
Sending IP: 103.99.1.143
From: Pablo Silvage <mini@blancmariclo.com>
Subject: Urgent Order 01001O02
Attachment: Order 01001O02.zip (contains "Order 01001O02.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23990.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/91443023d34f6eacea7ddde507261f746f96014a6a7b0a8dad2fe5dde61a0373/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 23:14:47 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sfcdai6tj5xkz2t53xsqojq7orxzmakknj5qvdnnf7s53zq2anzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Starter
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/91443023d34f6eacea7ddde507261f746f96014a6a7b0a8dad2fe5dde61a0373

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 91443023d34f6eacea7ddde507261f746f96014a6a7b0a8dad2fe5dde61a0373

(this sample)

AgentTesla

Executable exe d5313cb45c7eafd84a3d91d1b94d98693556f528bdad1e420433aed0b54fcae3

  
Dropping
MD5 3da0bb043e46a1ce6bc346726a23e1b6
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d5313cb45c7eafd84a3d91d1b94d98693556f528bdad1e420433aed0b54fcae3

Comments