MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31df99da709d5a58f18dc63e6b47a53f4c443af557588efcfdca59ccd4a83b2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31df99da709d5a58f18dc63e6b47a53f4c443af557588efcfdca59ccd4a83b2b
SHA3-384 hash: 7d589a52f15a1c6847718da458063f63cf8e5044c3b4c77d98b84fba5b32cb8728fc01afcee6ed0114c6b4d38a4efd89
SHA1 hash: c39f33fc69cffe6661ac91c682ac372d8925e343
MD5 hash: ac6843cb2bb529e4bf02a1ef5a1f7dff
humanhash: fanta-delta-robert-solar
File name:HONEYWELL RFQ.xlsx.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'081'135 bytes
First seen:2020-06-01 19:50:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:tJpFkrLBJsHlfNFdAoTpZD1NyqqMITIFLYMa:tJIrzcXTzXvPUMa
TLSH 323533E1AC1A2D8D93EE4B5C62D720D90BA880352F1F1EF165BB5300C695F7A985E7CC
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: subbecho.com
Sending IP: 103.147.184.73
From: rajendrasingh@subbecho.com
Reply-To: rajendrasingh@subbecho.com
Subject: RFQ Reference:7893234OM/RFQ/01/June 2020
Attachment: HONEYWELL RFQ.xlsx.zip (contains "HONEYWELL RFQ.xlsx.scr")

AgentTesla SMTP exfil server:
mail.radianthospitals.org:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 20:36:12 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ghpztwtqtvnfr4mnyy7gwr5fh5geioxvk5mi57h5zjm4zvfihmvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 31df99da709d5a58f18dc63e6b47a53f4c443af557588efcfdca59ccd4a83b2b

(this sample)

AgentTesla

Executable exe fda37343c02eaac7af22b198fc198928522ad9bd8e36f5766a2f2069c9dcba24

  
Dropping
MD5 660ac7069feb068748a23157481f41f4
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fda37343c02eaac7af22b198fc198928522ad9bd8e36f5766a2f2069c9dcba24

Comments