MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de870156434fd1f08183eb0d0192db31a458bbb1aa03bf2f52cb573b4217fc52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de870156434fd1f08183eb0d0192db31a458bbb1aa03bf2f52cb573b4217fc52
SHA3-384 hash: 509c258c99cb0e07c9c2aab1f6630c16eddf031f7c1844eda0e0a2edd9c39d72c877918fc54613a07105f8dfe4065cc8
SHA1 hash: 783a0d73aafa69f0b3fad85af50d5de3b5ee696a
MD5 hash: 2e09f7474c3ea49b4b3a64f66f2dccd5
humanhash: cat-nitrogen-south-autumn
File name:Order-3456007.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:607'765 bytes
First seen:2020-11-16 06:52:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ORZ7vm+A7BgWjQT9ObRjWsO9Xu6f9kfUyGi/pc0I3jg358JZtlN9:ORZ7e+Ijq9QRA9Xu66tRcF3jgCJFr
TLSH EDD42365AAFB058FC0C51A9169E1C23F13247BAB50F3CEABCA65B4E8778405071B9DCC
Reporter cocaman
Tags:AgentTesla zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Natalia<tj@skandi.dk>" (likely spoofed)
Received: "from mx1.dreamhost.com (ip138.ip-51-81-143.us [51.81.143.138]) "
Date: "15 Nov 2020 21:30:23 -0800"
Subject: "PURCH BRANCH. 086456 ORDER"
Attachment: "Order-3456007.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
151
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2008.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24083.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de870156434fd1f08183eb0d0192db31a458bbb1aa03bf2f52cb573b4217fc52/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-11-16 04:53:18 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=32dqcvsdj7i7bamd5mgqdew3ggsfro5rvib36l2sznltwqqx7rja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip de870156434fd1f08183eb0d0192db31a458bbb1aa03bf2f52cb573b4217fc52

(this sample)

AgentTesla

Executable exe cfb435bdd8d3e8b95c5c6ca82fd51b7f4369746ca664ff6d660d0715b58f07da

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cfb435bdd8d3e8b95c5c6ca82fd51b7f4369746ca664ff6d660d0715b58f07da
  
Dropping
AgentTesla

Comments