MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a9ecc1e3ec629621b18386a85c08b337a653ee6530984ffbb7d41790247730c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a9ecc1e3ec629621b18386a85c08b337a653ee6530984ffbb7d41790247730c
SHA3-384 hash: a3c3d757ceb3297a012627b8e375420bcd0d0d3227be21f5e4f44fce7fa9b09a581225bf772480baa3d99cbb222cd71d
SHA1 hash: e5fabdd2c55c21c545281330b81c878a0c76679a
MD5 hash: 294aca740f12a091c9ab9c6089912c37
humanhash: william-paris-undress-shade
File name:Purchase Order Glencore International AG.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:785'854 bytes
First seen:2020-07-16 07:14:22 UTC
Last seen:2020-07-16 07:15:43 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:fv/CeLEuZEMJET0R03Qpel+ThE+W4KkSIDJDlsvSQ+oXKzUoU3k50RMXRQKb2b:3qNMJI0R0gU+lE+PKYn0XKQ3FMXOKab
TLSH F4F43332BAC8F742AB53B7AFDDC9E8E826799BCAAD1144D6F34191D4D763C090218C13
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: se3i-lax1.servconfig.com
Sending IP: 173.231.200.204
From: Gabriel Steiner <gabriel.steiner@glencore.com>
Reply-To: Gabriel Steiner <gabriel.steiner@glencore.com>
Subject: [Glencore International AG] Request quotation for supply & manufacturing, Purchase Order no: GL34853487
Attachment: Purchase Order Glencore International AG.rar (contains "Purchase Order Glencore International AG.exe")

AgentTesla SMTP exfil server:
smtp.flowtech-eng.net:587

Intelligence

File Origin
# of uploads :
2
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a9ecc1e3ec629621b18386a85c08b337a653ee6530984ffbb7d41790247730c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 07:16:06 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bkpmyhr6yyuwegyyhbvilqelgn5gkpxgkmeyj753pvaxsashomga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 0a9ecc1e3ec629621b18386a85c08b337a653ee6530984ffbb7d41790247730c

(this sample)

AgentTesla

Executable exe 3091ca40c5f5ef59fe0baa4a04e1cd0b8263b6349dd0026f3fb23893f1a0fc38

  
Dropping
MD5 111511391fa304f83c4303524a947e54
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3091ca40c5f5ef59fe0baa4a04e1cd0b8263b6349dd0026f3fb23893f1a0fc38
  
Dropping
SHA256 ac096eae22a7f902793da67988ec4d86794135ce3375665343349f6b60755d88
  
Dropping
MD5 a0ec117d9f39578098d4cc1ec074b363

Comments