MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffa41de9394c54c03f5542aeeea435a676c281cf2f59eb4f4e2a580011c21bca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ffa41de9394c54c03f5542aeeea435a676c281cf2f59eb4f4e2a580011c21bca
SHA3-384 hash: 21b5555a8ca99226d666e409d4950e62476defde5e1f8a8afb327c05d2f7b5bc6a657806918e573e36aa96faac687568
SHA1 hash: 2d3a2f75a03b56ff20f456ea6a97a3fd0307ac21
MD5 hash: abc6fe2d10e70f9ba7435cd29c06a2af
humanhash: foxtrot-hotel-cola-emma
File name:NEW ORDER..inv.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:641'763 bytes
First seen:2020-07-30 08:47:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:g8jP0dVRrKiYYCEBzWFq50IfXMNFXc/RuGbfzkxYHVZ5UkYNZnmi0mr2fA7S:gQm/r0YCBFqiIe+JLArTmrmr26S
TLSH B6D4233B0479A32CFAFBE5FD7C4F26756A983B664FC508D7FA200240183BD6664652B0
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: WILSON <info@hampdenskb.co.uk>
Subject: NEW ORDER/// P.I policy terms.
Attachment: NEW ORDER..inv.zip (contains "NEW ORDER..inv.exe")

AgentTesla SMTP exfil server:
us2.smtp.mailhostbox.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.24083.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ffa41de9394c54c03f5542aeeea435a676c281cf2f59eb4f4e2a580011c21bca/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 08:49:04 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=76sb32jzjrkmap2vikxo5jbvuz3mfaopf5m6wt2ofjmaaeocdpfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ffa41de9394c54c03f5542aeeea435a676c281cf2f59eb4f4e2a580011c21bca

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ffa41de9394c54c03f5542aeeea435a676c281cf2f59eb4f4e2a580011c21bca

(this sample)

AgentTesla

Executable exe 221f5da25d402be75cc7e28bb3edc241f293284d28fd4f37d0bf88213de4456f

  
Dropping
MD5 09110d6067e758a651e6bad7f867678a
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 221f5da25d402be75cc7e28bb3edc241f293284d28fd4f37d0bf88213de4456f

Comments