MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 113c49d570f4c78c81e12fab318e401588a87fe01b9dd72b67619e9828f6aea0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 113c49d570f4c78c81e12fab318e401588a87fe01b9dd72b67619e9828f6aea0
SHA3-384 hash: c8a165bc33a40a54fcc76c4d66a3c79b79a505b743846dde95683fa344c4f4d01ab433de7eed02338ddfbf445d9c52c5
SHA1 hash: 076be7e0c7119040db51ca321a24205520d7c01c
MD5 hash: 2ea6aed185acc42ea68ba0a8afd25d6c
humanhash: low-autumn-sierra-spaghetti
File name:PO.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'288'797 bytes
First seen:2020-07-08 06:52:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:NgDNE7CsARfr5EwDNiRr3N2JseEYUi0A7S4Vlu:WNdxRTlZsx2WKQmu
TLSH 4155336163D00B3DF3BFAD7E86810B6711B6CD4DA3FE7B783DA55A80E8268C45D12981
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: [103.140.250.133]
Sending IP: 103.140.250.133
From: Megawin Switchgear Pte. Ltd <megawin.switchgear@outlook.com>
Reply-To: megawin.switchgear@outlook.com
Subject: REQUEST FOR QUOTATION.
Attachment: PO.zip (contains "po.exe")

AgentTesla SMTP exfil server:
mail.cka.com.sg:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/113c49d570f4c78c81e12fab318e401588a87fe01b9dd72b67619e9828f6aea0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 06:54:09 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ce6etvlq6tdyzapbf6vtddsacwekq77adoo5ok3hmgpjqkhwv2qa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 113c49d570f4c78c81e12fab318e401588a87fe01b9dd72b67619e9828f6aea0

(this sample)

AgentTesla

Executable exe fe853873f403fbfa348d5d8439e86fd98e6b70253a5bf85be85f3b9092a3ef14

  
Dropping
MD5 8f50e31ef203d266764b6f1f7f9bb955
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fe853873f403fbfa348d5d8439e86fd98e6b70253a5bf85be85f3b9092a3ef14

Comments