MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d914ed063b074eb855a3c67a78d6913b972ea0f380a8326888b717b0eedd1bbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d914ed063b074eb855a3c67a78d6913b972ea0f380a8326888b717b0eedd1bbc
SHA3-384 hash: 8c81b89686a25b75d81a1dd3c5f0f156984319b069339576f41d93b8d0eb4234be5dfa5d9500d9843df97f3b7c5daa94
SHA1 hash: ab399b6fd5f914d2f83f8b7086d199bb2f7f282f
MD5 hash: 2ba84f5d0d8aab3d250dadb995dd9b71
humanhash: vermont-foxtrot-neptune-aspen
File name:NEW ORDER FOR PERFUME EXCLUSIVE 100ML,.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:475'005 bytes
First seen:2020-06-04 07:07:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:txeeZ8CQJR622TzvsMhD37WfCqEvY5VM4yUG+gW:t38CQJR6hzv7hSCqEH4yUXgW
TLSH 48A423BE34820A658DCF70B0A8E03BAC2FE21D95F41E1BD45E5FB949827770EA151EC5
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: clicklife.clicklifeuae.ae
Sending IP: 64.64.4.134
From: GENOME PHARMACEUTICALS (PVT) LTD. <Procurement.genome@mail.com>
Subject: PURCHASE ORDER FOR PERFUME EXCLUSIVE 100ML,
Attachment: NEW ORDER FOR PERFUME EXCLUSIVE 100ML,.zip (contains "NEW ORDER FOR PERFUME EXCLUSIVE 100ML,.exe")

AgentTesla SMTP exfil server:
mail.hitechnocrats.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Errv-7996272-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 23:10:28 UTC
AV detection:
36 of 48 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3eko2br3a5hlqvndyz5hrvurhols5ihtqcude2eiw4l3b3w5do6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d914ed063b074eb855a3c67a78d6913b972ea0f380a8326888b717b0eedd1bbc

(this sample)

AgentTesla

Executable exe 0b1ce90ba8d64281d16d29dac2cd146e81d18359c572cfd92840dfffbcd0f713

  
Dropping
MD5 2b9f3dd40f399b8b1e2fd69795327c7d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0b1ce90ba8d64281d16d29dac2cd146e81d18359c572cfd92840dfffbcd0f713

Comments