MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c524393447503d0448432e38ec04e49ddf64fd27454da0712b76de56db33dbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c524393447503d0448432e38ec04e49ddf64fd27454da0712b76de56db33dbf
SHA3-384 hash: 609a1f2de00bee8f84c5d6ed44ee75d8bbab448a3a16172577277c0879d6015a537c680896e8edb2b004dd19faa3e2d2
SHA1 hash: 97a481323d8fbbf50979c9404741ba3471f8e9fb
MD5 hash: f1cdbb106478a230bcf7fbdf04729e5d
humanhash: london-hamper-football-kilo
File name:Quotation.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:376'217 bytes
First seen:2020-07-07 09:47:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:jzXL35yRKa+bfxjOv/5xvzY41cxha5FEZ+pnjHtDBGshW5ZDRcaDr29J3E8:jzD0R6L0v/r1IaFEUpDtDBGnZDRckr8
TLSH B084234B856E9D7892DEF84CE5F856477B181ED402DA3C119E202A4FA9F32F3BD608D4
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.ipblasta.com
Sending IP: 5.39.217.214
From: Ms.Kim Yu <tharden@womackelectric.com>
Subject: REQUEST FOR QUOTATION
Attachment: Quotation.zip (contains "Quotation.exe")

AgentTesla SMTP exfil server:
mail.actionassist.co.uk:587

AgentTesla SMTP exfil email address:
sales@actionassist.co.uk

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21199.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c524393447503d0448432e38ec04e49ddf64fd27454da0712b76de56db33dbf/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 09:49:04 UTC
AV detection:
33 of 48 (68.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=drjehe2eoub5areeglry5qcojho7mt6sorknubysw5w6k3nthw7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1c524393447503d0448432e38ec04e49ddf64fd27454da0712b76de56db33dbf

(this sample)

AgentTesla

Executable exe 0e9d40a6224af32e7fc0878ce4fb51cdb0c9d179f64d3bc5b6a1f1478c512960

  
Dropping
MD5 c856ab4630c743620d58a8b909450ad1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0e9d40a6224af32e7fc0878ce4fb51cdb0c9d179f64d3bc5b6a1f1478c512960

Comments