MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5595893529eba3ec4b2f78d73f40d2d1dfec03fff1e5af0d84d5888818c902e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5595893529eba3ec4b2f78d73f40d2d1dfec03fff1e5af0d84d5888818c902e3
SHA3-384 hash: 2e2914886bb04e9a654dc6e03d9114f78704584f15ba79c22d2883e984379dcaf433475270088579fb24dc01037bb602
SHA1 hash: 9a03c6cd354401652d1354688c76af0df2390d63
MD5 hash: 3522a51514a2806b059b74be97cbb80a
humanhash: washington-quiet-lima-idaho
File name:Order-AL-ADAA Co.Gz
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'053'026 bytes
First seen:2020-06-10 15:51:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:lSDUdSAgkfzu/wseqbmRhdsFs/v6XP3JbSOwi86GlWhtI:kOfgtYpqbses/veQOwioEhtI
TLSH E7253360B5655DA1D508CC46F01386AB9DC9B428FA9BDA3C26673AE51BFFC7334300E9
Reporter abuse_ch
Tags:AgentTesla gz


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.228
From: Abdulrahim khogali <office@jinpao.us>
Subject: Order for AL-ADAA Co
Attachment: Order-AL-ADAA Co.Gz (contains "Order-Required.exe")

AgentTesla SMTP exfil server:
smtp.yltab.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27681.XorExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.24083.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.AitInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 15:53:08 UTC
AV detection:
34 of 48 (70.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kwkysnjj5or6yszppdlt6qgs2hp6ya776hs26dme2weiqggjalrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5595893529eba3ec4b2f78d73f40d2d1dfec03fff1e5af0d84d5888818c902e3

(this sample)

AgentTesla

Executable exe cd5da7605f0fafa3b1b4415e7df169580bb27e5c11e5951f031ee9cb8df1e1ec

  
Dropping
MD5 f209610447bc34e6d5413f0a02bee824
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cd5da7605f0fafa3b1b4415e7df169580bb27e5c11e5951f031ee9cb8df1e1ec

Comments