MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98f4ed9056bf6d47a54b507312449344b7eef915f3be2915234ecd826b8b273c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98f4ed9056bf6d47a54b507312449344b7eef915f3be2915234ecd826b8b273c
SHA3-384 hash: 7cffa048d7869021ed8a6ef7a059f76a7f97d3596ae35cbb308f0d2844b84c133f4d6d687581e8e39282f5049c8f20ef
SHA1 hash: ab8c579d8d7861511825daa8d5dade85f7d98a96
MD5 hash: 6e02b4745709cc2813fe3e97f5359096
humanhash: spring-four-shade-tango
File name:PO9464-17082020.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:336'042 bytes
First seen:2020-08-18 06:21:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:cSDDe98/Db1AqKmM0htcCK9xmHxD2lWTBmWk6SDMITkwAOQKyo1B:cSDD7bIClemHxilgxyIJ1e
TLSH 7464231227865E33439B0767BE94F1E53E85A54C2C81BB836C810D5DB746307BA3BE30
Reporter abuse_ch
Tags:AgentTesla Yahoo zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: sonic317-28.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.129.83
From: Bazvl Hameed <uaemdx21@yahoo.com>
Reply-To: Bazvl Hameed <uaemdx21@yahoo.com>
Subject: PO#
Attachment: PO9464-17082020.zip (contains "PO#9464-17082020.bat")

AgentTesla SMTP exfil server:
mail.ejitech.com.ng:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98f4ed9056bf6d47a54b507312449344b7eef915f3be2915234ecd826b8b273c/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 06:23:05 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=td2o3ecwx5wupjklkbzreretis3656iv6o7csfjdj3gye24le46a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 98f4ed9056bf6d47a54b507312449344b7eef915f3be2915234ecd826b8b273c

(this sample)

AgentTesla

Executable exe 47672f6e9878e90daf03b5aa1262f130aec9ede37d5d3eeeadabf4f6c42144d4

  
Dropping
MD5 cf87c549aae1f107238dd0d63a372155
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 47672f6e9878e90daf03b5aa1262f130aec9ede37d5d3eeeadabf4f6c42144d4

Comments