MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 122aa3638280957adee78aae1e5c30eb03c70bb86fcc2bf409903b788e9f59a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 122aa3638280957adee78aae1e5c30eb03c70bb86fcc2bf409903b788e9f59a6
SHA3-384 hash: 7cda0131469df0f6bc800521840689677d7c79727702f3afdecba92bf985e4b98ca926530a8df7a39a5166849dcecafe
SHA1 hash: 8ed2fc855ac32cf8fdd38f95463ddf58447b24d4
MD5 hash: 3275bf4dbc1e6c4a7b4a9b5c1ea1f627
humanhash: beryllium-mars-asparagus-don
File name:Inquiry.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:400'732 bytes
First seen:2020-05-20 09:10:52 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:IITzc7oXQNyFvZzSznAsfsoF4/KhQc00YkWh2e1/RetjLAx57Z8U5vwi:f/JXCC1SbAsfsc00YAe9RmnA3SU5vwi
TLSH 4684235202BA27936426A7C32C36E6438CAC933BC6C2BC97A5F558B3F9705D57C4CAD1
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.h-email.net
Sending IP: 103.114.106.29
From: Jehyun Kim <jehyun.kim@hmart.com>
Subject: Inquiry
Attachment: Inquiry.z (contains "Inquiry.exe")

AgentTesla SMTP exfil server:
mail.advoicemediaworks.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 22:59:16 UTC
File Type:
Binary (Archive)
Extracted files:
294
AV detection:
18 of 30 (60.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=civkgy4cqckxvxxhrkxb4xbq5mb4oc5yn7gcx5ajsa5xrdu7lgta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 122aa3638280957adee78aae1e5c30eb03c70bb86fcc2bf409903b788e9f59a6

(this sample)

AgentTesla

Executable exe c0d8aad8ea40ea5a7ebfee2af334338a014a791dcc64b76c617e97212b4fb80b

  
Dropping
MD5 5204162e97b71bb60b2a409c82b6d5b0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c0d8aad8ea40ea5a7ebfee2af334338a014a791dcc64b76c617e97212b4fb80b

Comments