MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d34e609657b675a9b3d8980312b4e8fd344686ab9de0541b1c76ae27b31af964. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d34e609657b675a9b3d8980312b4e8fd344686ab9de0541b1c76ae27b31af964
SHA3-384 hash: 2049cc55e413a018db1c8a615e8fb3be08dcbfd6d737716c3279ff9b0ccb13e0ea28dff303a625604dc7e32b3555e231
SHA1 hash: eda3a02e44e99cb5638a923af89038dc20b12ba4
MD5 hash: 99723ba664ff7a6c8bc9bdd6cbae6324
humanhash: green-fifteen-july-sweet
File name:PO zip.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:644'417 bytes
First seen:2020-05-04 18:13:27 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:L0rTqP0PbgCDkglZPc6k6n31QYA+JOLjNs+yAsDU+UghQDdul/3E0VFN2bW:La1egXPjnFQYA+Gje1LXUAQD2rHAbW
TLSH 65D43325E634F8C3BE0E9E877ED7E7ADB7B54C402B0C5E9E31260DC49BA590B1604939
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: frf-ajf.ro
Sending IP: 89.45.174.241
From: VIM Orders LatAm <vim-orders-latam@mail.com>
Subject: 回复:Urgent PO
Attachment: PO zip.zip (contains "1Q7PqKI00aILjFM.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.291.1436.19710.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 13:00:05 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2nhgbfsxwz22tm6ytabrfnhi7u2enbvltxqfigy4o2xcpmy27fsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d34e609657b675a9b3d8980312b4e8fd344686ab9de0541b1c76ae27b31af964

(this sample)

AgentTesla

Executable exe 539900a999853a6783c7e700987248efd3307604d5ca3cc4bdc3e69cf3489e06

  
Dropping
MD5 bbc109b66d0e3ac4a6e6b3902c925f1d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 539900a999853a6783c7e700987248efd3307604d5ca3cc4bdc3e69cf3489e06

Comments