MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d28b74a5624ec38095dec960d3deac6bcb9b7a2a8038e4d3f4d146d3de7a4dc7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d28b74a5624ec38095dec960d3deac6bcb9b7a2a8038e4d3f4d146d3de7a4dc7
SHA3-384 hash: e102e85126ddf00ebc3449825da8538929687f45eb7d6a86915fd711abef2a9f1f62086e92a00c99ce2cb0cede49a492
SHA1 hash: 435b048c5ae862c37af073ae1893f9992cdf8584
MD5 hash: 9d72539a8ae83604478ee6a9fc013483
humanhash: uniform-cola-mobile-north
File name:Purchase Order SS19T90591.gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:351'381 bytes
First seen:2020-11-23 14:11:22 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:DFQu7qHIPBV/Wqqo795q9PQsX8C87AQ9Jtt8xEhZleoaLxW0oKWkJuhP+:H7qHCBlWqP3sQgU7AhxEheRLikYhm
TLSH 9074233F4389464FC36FC023A8AE3D176FD2896DCBE6A6CE6A4014FD19CC15457863A6
Reporter cocaman
Tags:AgentTesla gz


Avatar
cocaman
Malicious email (T1566.001)
From: "info <info@tivalicyprus.com>" (likely spoofed)
Received: "from oncyprus2.servers.prgn.misp.co.uk (oncyprus2.servers.prgn.misp.co.uk [185.119.175.220]) "
Date: "Mon, 23 Nov 2020 13:45:43 +0000"
Subject: "RE: Re: Purchase Order SS19T90591"
Attachment: "Purchase Order SS19T90591.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d28b74a5624ec38095dec960d3deac6bcb9b7a2a8038e4d3f4d146d3de7a4dc7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-23 14:12:05 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2kfxjjlcj3bybfo6zfqnhxvmnpfzw6rkqa4oju7u2fdnhxt2jxdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d28b74a5624ec38095dec960d3deac6bcb9b7a2a8038e4d3f4d146d3de7a4dc7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

gz d28b74a5624ec38095dec960d3deac6bcb9b7a2a8038e4d3f4d146d3de7a4dc7

(this sample)

AgentTesla

Executable exe c1823f0befbdf02c1275d0641e142aeebc8d70d9dab04816ada7339da23061e2

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c1823f0befbdf02c1275d0641e142aeebc8d70d9dab04816ada7339da23061e2
  
Dropping
AgentTesla

Comments