MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1243837954930a23c330683591fb7c2e187dc42887c42254633957216fafb8b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1243837954930a23c330683591fb7c2e187dc42887c42254633957216fafb8b9
SHA3-384 hash: 8c006de94363e637f71aa19d9b7989ce50fd4c5c440ae6ff2e1b7aa1126945b096a4a0485018ee54b8a112910ce341fb
SHA1 hash: eabf0e8cd09c891da9b7f1ab36bbfa9998cb9502
MD5 hash: a8b62cca02262292ad3fe6045ec82f60
humanhash: finch-music-romeo-victor
File name:Enquiry-Qatar.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'557'764 bytes
First seen:2020-05-18 13:39:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:8IGMguAKk3P6CS2wGBYYY2d/aEpRo54YrS64P8fFw7CuEcHOSjs5RBxKfnuT:8I5kfFwIUiRTYeWF5uUXRBxynuT
TLSH 4175337CE49A4E5E29CC3064F8F5AFCBC39501A18BD82F0391DBD929AB4C8F961657D0
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.214
From: office@jinpao.us
Subject: RFQ-INQUIRY
Attachment: Enquiry-Qatar.zip (contains "Enquiry-Qatar.exe")

AgentTesla SMTP exfil server:
smtp.yltab.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Stealer.19347.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 14:35:43 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cjbyg6kusmfchqzqna2zd634fymh3rbiq7ccevddhflsc35pxc4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1243837954930a23c330683591fb7c2e187dc42887c42254633957216fafb8b9

(this sample)

AgentTesla

Executable exe 95034687c0234adc6400e0cce0f13db71b230fd428dcf9ba540083a34edc7eb8

  
Dropping
MD5 04cbc5e34027afe1bfa460c5c658ae1e
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 95034687c0234adc6400e0cce0f13db71b230fd428dcf9ba540083a34edc7eb8

Comments