MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d92747010a9268afb6b49e85469143c40770b7d523bf8f978ecb1654445af09d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d92747010a9268afb6b49e85469143c40770b7d523bf8f978ecb1654445af09d
SHA3-384 hash: 736bd925d319f45470fc82df225149a0bf8b72b53c12d5cee7ef5f4f823a6d7dc86bd7d4fa5f2139af20fe5761333266
SHA1 hash: ceb1cd55b9c5ae9d08487be31c7c24239ec9371e
MD5 hash: b8303bcce8e8d36eb34ccb1fdbeae8da
humanhash: uniform-floor-monkey-lactose
File name:Purchase Order.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:394'287 bytes
First seen:2020-05-27 08:12:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:fYIO2Zfzu04g+JO0O/vhlUbwxWdJIUR3d4QIb01Gew3By93g:QIdquCiEuEIUhdUcq3o9Q
TLSH 338423253336B4C61B8E4978FB64A88775DB3F522A337E91278CE161D120AF14E4399E
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx.tituae.com
Sending IP: 195.231.83.90
From: "Account Department" <user@tituae.com>
Subject: Re:Purchase Order
Attachment: Purchase Order.zip (contains "Purchase Order.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.20845.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 09:12:32 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip d92747010a9268afb6b49e85469143c40770b7d523bf8f978ecb1654445af09d

(this sample)

AgentTesla

Executable exe 097dc388040d619c874beb1b1f407234ceca08b2065fce29e5084e0b9d195987

  
Dropping
MD5 024c49cc5106a47f1bf5eb33f4031b4d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 097dc388040d619c874beb1b1f407234ceca08b2065fce29e5084e0b9d195987

Comments