MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25a791c6f1c9929a7364832ca44d781e8bfc7b765482e6ebf90827259a2fb6b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 25a791c6f1c9929a7364832ca44d781e8bfc7b765482e6ebf90827259a2fb6b9
SHA3-384 hash: d91d94e9c75a4078b3f3706e28c70df0aa8767dce2b8f2d6c6e3a4ef3b4696c27d0c1ad617a87f79d113a956bf2f4138
SHA1 hash: 86a89a81fd5033e1f65c6f7a0db6ad63366b8bb0
MD5 hash: cc9bbb938363ff16239eacda96f832e6
humanhash: uncle-earth-october-floor
File name:Clearance_documentsFORM E.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:922'074 bytes
First seen:2020-08-19 14:01:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:T+J8qAaDj+akcNKXP5dk3H9JxFY9+OP2yQMn+:lqAujV1NKXnYLxFY92yQK+
TLSH 8C153384601F40E38FAC0A5914DE65F7C9740FC97DE5932B8B9C347AF595EA9EC2102E
Reporter abuse_ch
Tags:AgentTesla FedEx zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: server.example.com
Sending IP: 62.171.146.191
From: TIANGEN, Beijing, China <joyjoy@bengiamein.gq>
Subject: FW: FEDEX TRACKING NUMBER: 777108113246.
Attachment: Clearance_documentsFORM E.zip (contains "Clearance_documents(FORM E).exe")

AgentTesla SMTP exfil server:
smtp.outlook.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.53688.18847.4643.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/25a791c6f1c9929a7364832ca44d781e8bfc7b765482e6ebf90827259a2fb6b9/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-19 14:03:05 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ewtzdrxrzgjju43eqmwkitlyd2f7y63wksbon27zbatslgrpw24q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/25a791c6f1c9929a7364832ca44d781e8bfc7b765482e6ebf90827259a2fb6b9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 25a791c6f1c9929a7364832ca44d781e8bfc7b765482e6ebf90827259a2fb6b9

(this sample)

AgentTesla

Executable exe f448b48505882a50dd6e5f08020280129dca9ef8c41fcdbd0f46655499ff49b4

  
Dropping
MD5 b4700f953f98341ecf61b6efe10efdc1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f448b48505882a50dd6e5f08020280129dca9ef8c41fcdbd0f46655499ff49b4

Comments