MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0dc42939bcb5d5b0e8a9c6fda2e1264134563734e6c24ffd453fc71fb608d7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b0dc42939bcb5d5b0e8a9c6fda2e1264134563734e6c24ffd453fc71fb608d7e
SHA3-384 hash: e1ed28dff8eeb441bbbe8026618ad5e2001e99658c697c3c3a7b10f77dd8c6b1a5349c5932b99f6b44e1b633c82b08d8
SHA1 hash: e6bef296ba6428143da1ae3ebbf8fa6d24d77aec
MD5 hash: 31a4debf805de4c0c536db52ae5f9103
humanhash: venus-william-salami-illinois
File name:Revised Order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'002'623 bytes
First seen:2020-06-03 08:19:37 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:OQjxw+y7cSSwk7kEDulmX9BXirqOb0Fq9wgzO:0+ySpvuYX9BX8qm0FewkO
TLSH 9525233420858AFDF593D00F609058D347629329FAF5AA2FC64BBEA19FFB1C5D65422C
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: biz-delivery.info
Sending IP: 178.124.131.162
From: B.G.A - Group <admin@biz-delivery.info>
Subject: Re: Revised Order
Attachment: Revised Order.zip (contains "Revised Order.exe")

AgentTesla SMTP exfil server:
smtp.poongln.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 04:29:39 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wdoefe43znovwduktrx5ulqsmqjuky3tjzwcj76ukp6hd63arv7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b0dc42939bcb5d5b0e8a9c6fda2e1264134563734e6c24ffd453fc71fb608d7e

(this sample)

AgentTesla

Executable exe 56c86f76934005ff25803fc7b71dfbde700ebe9bec9fa69959c16672fd458e59

  
Dropping
MD5 c846a747027c16f452fb6322de6a20a4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 56c86f76934005ff25803fc7b71dfbde700ebe9bec9fa69959c16672fd458e59

Comments