MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0f61e79af881c03f612cb52bda26bf49c99194ccffcb8eac582dd289a66b83f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b0f61e79af881c03f612cb52bda26bf49c99194ccffcb8eac582dd289a66b83f
SHA3-384 hash: 9399b1e714a8610cf543c94802269ea2a59c9a8fe089ab34eab61cf62a02848e0d36c392a6d8eeb4d41cd75033747f56
SHA1 hash: cdd1e3639272034779f8d8827db5bb5a33d468ac
MD5 hash: a3d0590757cd05e78e96a10a9ba61cbb
humanhash: bluebird-yellow-delaware-sixteen
File name:PurchaseOrder.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:395'145 bytes
First seen:2020-10-30 15:10:56 UTC
Last seen:2020-10-31 06:37:40 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:KkGJB0vBguRbORo6C8TxlcJ5SNA9O9RDeBdIM6B+VjoynY5Obi/mEgu/sH5WQ:DG+guR+o6C+E4IPOcjoQYstnZr
TLSH DC8423E32C064374E5A0903067BE8DF7C61D01D07CD8976EFAD69E963CB2DD0A1A499B
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Donald Dudley <donald.dudley@bahri.sa>"
Received: "from bahri.sa (unknown [45.137.22.131]) "
Date: "30 Oct 2020 10:03:18 -0700"
Subject: "RE:Purchase Order / 860-51801/O "
Attachment: "PurchaseOrder.zip"

Intelligence

File Origin
# of uploads :
6
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23220.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b0f61e79af881c03f612cb52bda26bf49c99194ccffcb8eac582dd289a66b83f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-30 15:11:08 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wd3b46npraoah5qsznjl3itl6sojsgkmz76lr2wfqlosrgtgxa7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b0f61e79af881c03f612cb52bda26bf49c99194ccffcb8eac582dd289a66b83f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip b0f61e79af881c03f612cb52bda26bf49c99194ccffcb8eac582dd289a66b83f

(this sample)

AgentTesla

Executable exe b156d54df509f02bed378383dc278b7da2a6ba2db0846d4c1086a3196c5bd8db

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b156d54df509f02bed378383dc278b7da2a6ba2db0846d4c1086a3196c5bd8db
  
Dropping
AgentTesla

Comments