MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9e232763c259e156c3a1f98d7289d54d09d66c126a17567ad12e8a850b92cbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9e232763c259e156c3a1f98d7289d54d09d66c126a17567ad12e8a850b92cbb
SHA3-384 hash: ee970d4f5b8a07c6b5a2e86f748e27c0b44a36afdb73dd89391d439bf5f06a4c788e3f44b1bcd9025541190d68aebade
SHA1 hash: 672f08f4c848f18d5e7f356281c60434fa17a2eb
MD5 hash: 018e092fa76e8e385cfc7a7531133467
humanhash: texas-uniform-magazine-maine
File name:PO.UUE
Download: download sample
Signature AgentTesla
Create hunting rule
File size:953'315 bytes
First seen:2020-07-30 10:10:12 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 24576:QbUGmJplVHaXQ5G483wK21uMAkYVXLjwjAzJZ1p:QbUGAp8xq1BdYV7jwjaZ1p
TLSH 8F153308F2B0145C49C8FA993FE2E84991BE935903988AAD791BC50E5A4726DF723C79
Reporter abuse_ch
Tags:AgentTesla uue


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mx1uk.supremebox.com
Sending IP: 46.249.205.81
From: Ismail Temel <muhammad.p@shaklangroup.com>
Subject: Fwd: Re: Urgent Purchase Order
Attachment: PO.UUE (contains "tttttttt.exe")

AgentTesla SMTP exfil server:
smtp.mail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e9e232763c259e156c3a1f98d7289d54d09d66c126a17567ad12e8a850b92cbb/
Threat name:
ByteCode-MSIL.Spyware.BtcWare
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 10:12:06 UTC
AV detection:
14 of 27 (51.85%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5hrde5r4ewpbk3b2d6mnoke5ktij2zwbe2qxkz5nclukqufzfs5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DriveBy Activity
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/e9e232763c259e156c3a1f98d7289d54d09d66c126a17567ad12e8a850b92cbb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

uue e9e232763c259e156c3a1f98d7289d54d09d66c126a17567ad12e8a850b92cbb

(this sample)

AgentTesla

Executable exe b358b1ea537bc5e2dd3ddddbd1e9884770665569d5baaf20c2edb73cdd90ac60

  
Dropping
MD5 5fe5676bff55e8f0e704e3c39d175a45
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b358b1ea537bc5e2dd3ddddbd1e9884770665569d5baaf20c2edb73cdd90ac60

Comments