MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5562240396a887bf6d20e41a54c07a0ea27a0df0c98fb0ceced77c525e27e49d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5562240396a887bf6d20e41a54c07a0ea27a0df0c98fb0ceced77c525e27e49d
SHA3-384 hash: e9ec03723eef09d7d7a6615ab4b82c825ef02393a706f7f55a4bd222f7797629f0c5036977cd74f8b8f5057ac724543e
SHA1 hash: b9c000eec72881c7e14b1006f838600d38f77575
MD5 hash: a6fa02dea005b28f930d1e8475dab51b
humanhash: black-georgia-butter-earth
File name:Plumbing Pumps RFQ.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:663'960 bytes
First seen:2020-05-25 08:37:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:xnYAM6aCSJwbUa0XPcu5TJeuBeRXK2SejmKyAJHYtMo2ClXY+hhGQ8Zt:xnO3CVbUa6XeuBeBABW62ClXY+hhZ8Zt
TLSH D3E4231C5F5A30A1DE5D910FD22F2B8146BBCAC0F1D4922C3685FA3DA58D6A58DC06FB
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: ihcc.sa
Sending IP: 209.58.149.66
From: Dilawar Iqbal Qureshi <pur11@ihcc.sa>
Subject: Quotation Request - Plumbing Pumps - SGH Extension Dubai - IHCC UAE
Attachment: Plumbing Pumps RFQ.zip (contains "Plumbing Pumps RFQ.exe")

AgentTesla SMTP exfil server:
mail.privateemail.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.LuheMalumA.12985.16793.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 10:40:32 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5562240396a887bf6d20e41a54c07a0ea27a0df0c98fb0ceced77c525e27e49d

(this sample)

AgentTesla

Executable exe 5a1ff51485fd7f49e413093ab5c705265a6d5ec108c1ce955fbe99da3d29aa33

  
Dropping
MD5 9e831c7cfe7af7d9abead8e8fe57187c
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5a1ff51485fd7f49e413093ab5c705265a6d5ec108c1ce955fbe99da3d29aa33

Comments