MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a2a1daa1760a7423f2b755dea3b32ccb7efc5a4b3ddd866f1de2eafcbf7c9d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a2a1daa1760a7423f2b755dea3b32ccb7efc5a4b3ddd866f1de2eafcbf7c9d0
SHA3-384 hash: 8cdca60046411e5aa304116e13e4cf3cdd7c031b9b572f71deea927301af78ad7aee91a3872cfd1e6c7d7f6224db0fb2
SHA1 hash: 420c85280098e08c719ec0addcde33e9b893f893
MD5 hash: d2a4fe5fcdba15677f2a71fe64d60931
humanhash: finch-beer-utah-minnesota
File name:QUOTATION
Download: download sample
Signature AgentTesla
Create hunting rule
File size:863'622 bytes
First seen:2020-07-07 08:48:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:tZh01DhswE2oX1/PwPOdbbWJ6eH9aK8kLvmH:rhWDhswEdFPAOdbKJ6UYH
TLSH D80533B5DEBA62D7E76A813A3410D42FC8B04F74850E26CA00EFD0F9D9A581D2E659D3
Reporter abuse_ch
Tags:AgentTesla QUOTATION


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: antyca.vservers.es
Sending IP: 91.142.220.128
From: Jean-Paul Mochet <Jean-PaulMochet@franprix.com>
Subject: URGENT INQUIRY...
Attachment: QUOTATION (contains "promise cripted.exe")

AgentTesla SMTP exfil server:
mail.insooryaexpresscargo.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a2a1daa1760a7423f2b755dea3b32ccb7efc5a4b3ddd866f1de2eafcbf7c9d0/
Threat name:
Win32.Hacktool.CeeInject
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 08:49:06 UTC
AV detection:
23 of 47 (48.94%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jivb3kqxmctuepzlovo6uozszs367rnewpo5qzxr3yxk7s7xzhia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 4a2a1daa1760a7423f2b755dea3b32ccb7efc5a4b3ddd866f1de2eafcbf7c9d0

(this sample)

AgentTesla

Executable exe 21d19ba98de8b710605e144809cae73bc3b7606cfc49e995a267cf44e4c2638f

  
Dropping
MD5 5e5769b61d855338e115f91ec350d27d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 21d19ba98de8b710605e144809cae73bc3b7606cfc49e995a267cf44e4c2638f

Comments