MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 445d20c663f7519111f9ac636ed476434f786566f25fe294ea05dbefc17f6342. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 445d20c663f7519111f9ac636ed476434f786566f25fe294ea05dbefc17f6342
SHA3-384 hash: 662a47f87a62061f0d7383fd633cc5b6742050bb55a496c3fc65715106a73775bcf2004eec7c9335a019b3bdabd96182
SHA1 hash: 1dcf120377fca8a33224ac52ca7cb626331de9aa
MD5 hash: 8f2194b283e8267b34261ed2b652b5ae
humanhash: papa-oscar-violet-fillet
File name:RFQ 110620.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:489'697 bytes
First seen:2020-06-11 05:42:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:4YqN8YhPZPPhFNyJCyO+ovBMasH2u2sWyeAMXf:4TntZPPwJ3O+ovBMTT29ytMP
TLSH 42A423D459C45B40E019B0A26DABFF2C340DF226106CAA81D72DDD72F60627EEF5B17A
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: distribucionesduch.acens.net
Sending IP: 176.28.110.186
From: Rita Song <rita@desheng-precision.com>
Reply-To: Rita Song <rlta@desheng-precision.com>, Rita Song <rlta@desheng-precision.com>, Rita Song <rlta@desheng-precision.com>
Subject: Quotation Request (DESHENGRUI MACHINERY).
Attachment: RFQ 110620.zip (contains "3BtMySHqIUY2IXw.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 05:43:06 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=irosbrtd65izcepzvrrw5vdwinhxqzlg6jp6ffhkaxn67ql7mnba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 445d20c663f7519111f9ac636ed476434f786566f25fe294ea05dbefc17f6342

(this sample)

AgentTesla

Executable exe d444059c72ee1b5b335eed7d5985b959c831d4508860222eb277683e77d02eb7

  
Dropping
MD5 49bc1cf148693577c1b789bc591fa565
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d444059c72ee1b5b335eed7d5985b959c831d4508860222eb277683e77d02eb7

Comments