MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e27ca0508d3467121be350b09cdaf7c2a12df75c8f7de0fcbb2e797bf03c950. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e27ca0508d3467121be350b09cdaf7c2a12df75c8f7de0fcbb2e797bf03c950
SHA3-384 hash: 6eb86849ad1c44886253b6b1efab83ddf96c6a27e1284b346f930118befcee6314db4743ce3581a701e6178d089ff18b
SHA1 hash: ac2862b5044817e2723e47d9f69f74116aa7db70
MD5 hash: 8a2474314fc3959ea4dac8c2d24a92fa
humanhash: nevada-queen-london-connecticut
File name:PURCHASE ORDER.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'262'291 bytes
First seen:2020-05-04 17:22:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:3W44h2i7bGPDHTuZ70nCQwW7CDfeOLfrvo+DEgkvf/AqV70HbyySbWNJQTn9Yaqg:3W44hX7qjTuZgFwWGNrvXEBhZ0HbyANK
TLSH F845337949D62D3EC28DE9DCDB41F65DD8D5B8E0715C2B4DBC31AE18B1CAAB822320D4
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: pdlc34160.ciberserver.com
Sending IP: 176.221.34.160
From: SARFARAZ <autocraf@emirates.net.ae>
Subject: Please find attached our LPO
Attachment: PURCHASE ORDER.zip (contains "PURCHASE ORDER.exe")

AgentTesla SMTP exfil server:
smtp.yandex.ru:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22360.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 01:06:44 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tyt4ubii2ndhcin6gufqttnppqvbfx3vzd354d6lwltzppydzfia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9e27ca0508d3467121be350b09cdaf7c2a12df75c8f7de0fcbb2e797bf03c950

(this sample)

AgentTesla

Executable exe d23160f942937c33e3a828ca8eb3caa8ed69dc8295b9a019b66b16dbd1a2a0c2

  
Dropping
MD5 52bb293c196507cdddcd7eefb17be2d4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d23160f942937c33e3a828ca8eb3caa8ed69dc8295b9a019b66b16dbd1a2a0c2

Comments