MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2dc91845c1f82bdbdd536baa92776ce51c7c3cb2c77490b21fd5efc0721142c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2dc91845c1f82bdbdd536baa92776ce51c7c3cb2c77490b21fd5efc0721142c
SHA3-384 hash: 53ece8de24db273fe77df248c91c4b9ac0283f8de9582b932af855bd3cfc8d1143ba6d8c63043b4dfb8f616c9f3f3922
SHA1 hash: 5ee7a32ed4d2f65094f56b28b30351f1eeb23d48
MD5 hash: 83bde6ad8dc5fcd8644a05d60065dfc9
humanhash: april-spring-may-hydrogen
File name:PO 304161.LZH
Download: download sample
Signature AgentTesla
Create hunting rule
File size:34'466 bytes
First seen:2020-10-22 07:06:40 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:y/UE7GKVU/76e4CuCzjKeOsRdzu+oGmzmIT8cHVz8V3hEsp3+ZBOXx3nFKFFO2xn:xXDmC9POsLSoashlpOu0F9zV3ExokU
TLSH 52F2E07CC2A56E16F500013CDEEE6429BA45EB5BDF9C7D41C232A2176F68170983EE62
Reporter abuse_ch
Tags:AgentTesla lzh Yahoo


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: sonic302-19.consmr.mail.ir2.yahoo.com
Sending IP: 87.248.110.82
From: CAJA INC <amanda_johnson00232@yahoo.co.uk>
Reply-To: CAJA INC <amanda_johnson00232@yahoo.co.uk>
Subject: PURCHASE ORDER
Attachment: PO 304161.LZH (contains "PO 304161.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b2dc91845c1f82bdbdd536baa92776ce51c7c3cb2c77490b21fd5efc0721142c/
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 06:51:29 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wlojdbc4d6bl3povg25ksj3wzzi4pq6lfr3usczb7vppybzbcqwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar b2dc91845c1f82bdbdd536baa92776ce51c7c3cb2c77490b21fd5efc0721142c

(this sample)

AgentTesla

Executable exe da8df4bae3a3ee7500b5de14c09ebf28b2928442c0282d713085efe0fa559b38

  
Dropping
MD5 2f3934dbe42ecb3474303507fbe15255
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 da8df4bae3a3ee7500b5de14c09ebf28b2928442c0282d713085efe0fa559b38

Comments