MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 693fc90fd7182e1348801c1f594ebcb9f33d0f3aed5610064f5ba29810967d34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 693fc90fd7182e1348801c1f594ebcb9f33d0f3aed5610064f5ba29810967d34
SHA3-384 hash: b22ff4d5fae66ee4002f6b0a6d9f4e0c24aaa9397fedddff3c8b2abb8bfb35ad81b78cabcb56c6c55f138da2a0a99933
SHA1 hash: 052a24edce4ec7a3b66b3a3b1278d50115f982f4
MD5 hash: 5307801fa115a8e43b130a0485688cb5
humanhash: illinois-tango-green-triple
File name:RFQ.Z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:775'375 bytes
First seen:2020-05-18 08:31:50 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:75c/q/cyupuyCE0YZYJkIKuRrV0MZYAhLqgCFXfIa1nXgbaEBjeEr4yy4NIirICI:lc/q0Hp/pZ9I1gMLiXGlwC5ICwVYfY
TLSH FDF42323E90373053DBE067B6E2B00BBBAAF4A39C1E43E51061E0553A24EEDF54BD915
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: crasty.landofkush.com
Sending IP: 109.201.140.52
From: kavita kotian <customer-reply@crasty.landofkush.com>
Subject: FW: Specification Order P.O#DIS0515201
Attachment: RFQ.Z (contains "PO#7571.pdf.exe")

AgentTesla SMTP exfil server:
mail.kteadubai.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 08:36:04 UTC
File Type:
Binary (Archive)
Extracted files:
590
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ne74sd6xdaxbgseadqpvstv4xhzt2dz25vlbabsplorjqeewpu2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

z 693fc90fd7182e1348801c1f594ebcb9f33d0f3aed5610064f5ba29810967d34

(this sample)

AgentTesla

Executable exe 8b62b30e2e77f1b061adc9641b6c082070c99f71e3509f2b3b90203bc9dd96e3

  
Dropping
MD5 70fd5fc9cece362b7b40a7aa625be40d
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8b62b30e2e77f1b061adc9641b6c082070c99f71e3509f2b3b90203bc9dd96e3

Comments