MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4127a9cc63bf9da15c2e433d27254bfdb8191502e5fd5f295f272bc3b9478898. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4127a9cc63bf9da15c2e433d27254bfdb8191502e5fd5f295f272bc3b9478898
SHA3-384 hash: b6fef0c97db82159c47f3add4273fda3d9c9ca23307f31656fbff523475c42d1f42dad4ccc3c7d9d1513f7b4c87cdb38
SHA1 hash: 866212d78a1ba219d9511186a8d54f28c3e6e98b
MD5 hash: d44fa1d28d9138fadf57147b8b4a5d0e
humanhash: twenty-red-table-low
File name:rfq190520.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:425'525 bytes
First seen:2020-05-19 06:06:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:wIR/zFlTnUOTgflcjRPAkVtNoSusQGPMxB1qGEe9:hFncf4KIgSuLPfd
TLSH 399423E31F2653AB392AAD9BC20C74ED01AAB58E9770C4D975BF2788E0FE510305D847
Reporter abuse_ch
Tags:AgentTesla HSBC zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.hsbcnet.hsbc.com
Sending IP: 103.207.38.157
From: HSBC Advising Service <advising.service.105399952.810805.2680324820@mail.hsbcnet.hsbc.com>
Subject: Payment Advice - Advice Ref:[GLV124182676] / ACH credits / Customer Ref:[100000265388] / Second Party Ref:[KW05200000032220]
Attachment: rfq190520.zip (contains "rfq190520.exe")

AgentTesla SMTP exfil server:
mail.onesmartcard.co.za:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.47097.9969.22727.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Nanobot
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 06:36:42 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iet2ttddx6o2cxboim6sojkl7w4bsfic4x6v6kk7e4v4hokhrcma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 4127a9cc63bf9da15c2e433d27254bfdb8191502e5fd5f295f272bc3b9478898

(this sample)

AgentTesla

Executable exe 0eaa7e8f673add2154bdd6902103b235d4729a36dc53c5a3c660356dd0152e3d

  
Dropping
MD5 7db6cb763d297df9d352dc447776821f
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0eaa7e8f673add2154bdd6902103b235d4729a36dc53c5a3c660356dd0152e3d

Comments