MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9228a7ad00775e123859dfddc98d74dc7d638f08246e9588650bb8c52fc335d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9228a7ad00775e123859dfddc98d74dc7d638f08246e9588650bb8c52fc335d3
SHA3-384 hash: 04da3ebb998d03f12b9bef0006e769dd11ebe72782dd79a4d7cc1d9d0d82c6f8b50fa9d131ee4cdd0a302266d31f2d14
SHA1 hash: a204f8c556a4428d9af61cef53a18356362ad2a1
MD5 hash: 2029c8a1d1520bd342e9e96f023474c7
humanhash: minnesota-mobile-solar-bluebird
File name:Purchase order.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:445'637 bytes
First seen:2020-12-03 08:47:32 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:wJl9EnOwr/9xiOGCddcHW0wbJUPx9hyEMvMmPpvcfsPmgNK/Cj/rIvQbCh9im1C1:sleOwz9xvGICJaVhfg/OIobChcdMyQEf
TLSH 64942382B085BABC458C54A055C2C319F7CD9BEBB1C01DD063962BE36BCE4F4E6B3695
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vps.desourdo.com
Sending IP: 45.85.90.133
From: William Cai <william@datanetsol.com>
Subject: PO908453-Purchase Order
Attachment: Purchase order.z (contains "Purchase order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9228a7ad00775e123859dfddc98d74dc7d638f08246e9588650bb8c52fc335d3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-03 08:48:04 UTC
AV detection:
14 of 27 (51.85%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=siukpliao5pbeocz37o4tdlu3r6whdyierxjlcdfbo4mkl6dgxjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9228a7ad00775e123859dfddc98d74dc7d638f08246e9588650bb8c52fc335d3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 9228a7ad00775e123859dfddc98d74dc7d638f08246e9588650bb8c52fc335d3

(this sample)

AgentTesla

Executable exe a12f642139a7cfe0891e40b83400cae049a06c959f742700d47f096ccaa32736

  
Dropping
MD5 ff6b007f99b2f951d225e1a1749019fa
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a12f642139a7cfe0891e40b83400cae049a06c959f742700d47f096ccaa32736

Comments