MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a9cc0e95c6ee95e9e01c3a1895e460be7672656320309ff3dd3d911e479f773. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a9cc0e95c6ee95e9e01c3a1895e460be7672656320309ff3dd3d911e479f773
SHA3-384 hash: 2c7e749894202e75299bba7ceb7695625b28762c06c449ae8769f0d48877bae65c51eb768c7906326f60d8351d1f2148
SHA1 hash: c47902b0f03d2468e5f6c51a50ebe828974c01f3
MD5 hash: 71d19c8d4a408bd41701b60882166c6a
humanhash: jig-island-earth-enemy
File name:RFQ- EGHR20-021173.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:478'215 bytes
First seen:2020-06-18 15:32:37 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:VjAPdXdorvUQHZREueCKuSvCbt51XAg5tKdzxx2+N6QmPz7k5BK:V4XdozUwfVeCSiDl1KdnybqBK
TLSH 83A4234EC1B306FD90982A1A05C4F604CD23FFFC5659E7605A07A93592C9D8E7C2E4BB
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: webmail.cyber.net.pk
Sending IP: 203.101.175.37
From: TIONG PROCUREMENT DIRECTOR <centcorp@cyber.net.pk>
Subject: Request quote_Eng Guan On [RFQ- EGHR20-0211734,EGHR20-0211724,EGHR20-0211735 & EGHR20-100324]
Attachment: RFQ- EGHR20-021173.zip (contains "RFQ- EGHR20-021173.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Variant.Graftor.775012.17510.17428.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 15:35:37 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lkomb2k4n3uv5hqbyoqysxsgbptwojswgibqt7z52pmrdzdz65zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 5a9cc0e95c6ee95e9e01c3a1895e460be7672656320309ff3dd3d911e479f773

(this sample)

AgentTesla

Executable exe b5c789df1e256f4fac8c278ae0d5d6fa3f764d1703722b8b71cf5a7d94fb4b71

  
Dropping
MD5 50c7b3725066e2fda5583ae2d7bc1eaa
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b5c789df1e256f4fac8c278ae0d5d6fa3f764d1703722b8b71cf5a7d94fb4b71

Comments