MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff0e2b7ff0f180f02ef2a715c454b0977f9ee5da26a73380075797aeadf1573d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff0e2b7ff0f180f02ef2a715c454b0977f9ee5da26a73380075797aeadf1573d
SHA3-384 hash: 5c64c57748a3a948482d2ff6278091c7f7199e9f53eaeeb9ee7401bc6da9887142570f00881ae3b9dece4c0d234fe4d1
SHA1 hash: 56c10566c051086e2eecc3579925a132b92d67a8
MD5 hash: d00f31768ec5bcc5bae8be16662f933c
humanhash: steak-tango-vermont-hotel
File name:PO123066.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:562'535 bytes
First seen:2020-12-30 09:26:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:GCNTNPOTqBlPXEQ0JOEHQY9ZO2dYVgFlYnYUY2pkj96/K2PTI476:GCNh/Bl70YEHQYOrgFynbY2pkj9fQ886
TLSH 98C423D685A8CEB552A160C7C7A6F45D6364F7CF2A6848F38CA06B6819CE5E21FC3120
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: localhost.localdomain
Sending IP: 123.200.19.3
From: sunaree.pon@richmilbon.co.th<sunaree.pon@me.net>
Subject: Re: Sample Order.
Attachment: PO123066.zip (contains "PO123066.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
334
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1137.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff0e2b7ff0f180f02ef2a715c454b0977f9ee5da26a73380075797aeadf1573d/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=74hcw77q6gapalxsu4k4ivfqs57z5zo2e2tthaahk6l25lprk46q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ff0e2b7ff0f180f02ef2a715c454b0977f9ee5da26a73380075797aeadf1573d

(this sample)

AgentTesla

Executable exe 84040132d504dbc295119c29d7a8262392bf09caca8ede8236a26e2cab0ace6e

  
Dropping
MD5 f37722e26a53b70991dc5cac7ac273c7
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 84040132d504dbc295119c29d7a8262392bf09caca8ede8236a26e2cab0ace6e

Comments