MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b24e34885a3daa75976b31d6aa947aa89526500e0f7ef4bfc67bd8605ed8bd2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b24e34885a3daa75976b31d6aa947aa89526500e0f7ef4bfc67bd8605ed8bd2a
SHA3-384 hash: f28d8b706d9fa1e3aba80674d439908868a190015eeb8a2208195cbe28357c00a218ffc350b22def00ffc58807bc62c0
SHA1 hash: 1f4022fd64c82bcbbb71b69e105279f60034efec
MD5 hash: ff7a4ce24c57b9b89ffde0b7320ab9a5
humanhash: wisconsin-winter-sweet-berlin
File name:PURCHASE ITEMS.7Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:18'480 bytes
First seen:2021-02-23 07:21:35 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 384:/mZjj7gJETQmY5FoLzxCBa0x6BgQMqy+e8OrwjnQKaf0dWeak:uZP0B52x656K5qyj8Or+nQKafJe
TLSH 2D82D11CC001DA22F21654F8B969282A55BCA33F2CF597C56978B9E64FFEA83850245F
Reporter abuse_ch
Tags:7z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: coolermaster.com.tw
Sending IP: 45.133.116.243
From: Raffizas<sales@coolermaster.com.tw>
Subject: purchase order
Attachment: PURCHASE ITEMS.7Z (contains "PURCHASE ITEMS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b24e34885a3daa75976b31d6aa947aa89526500e0f7ef4bfc67bd8605ed8bd2a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 07:22:15 UTC
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wjhdjcc2hwvhlf3lghlkvfd2vcksmuaob57pjp6gppmgaxwyxuva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b24e34885a3daa75976b31d6aa947aa89526500e0f7ef4bfc67bd8605ed8bd2a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

7z b24e34885a3daa75976b31d6aa947aa89526500e0f7ef4bfc67bd8605ed8bd2a

(this sample)

AgentTesla

Executable exe 2760abb67bdb754b7e7878df83549c332785054b337800e7598a4f394a81da12

  
Dropping
MD5 dd31cca735c2f9f3406417566528d712
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2760abb67bdb754b7e7878df83549c332785054b337800e7598a4f394a81da12

Comments