MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86fecd8ff730ae95b812db4d0571823ba3bd4d24f0254f872d7bbc5fbbccda2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86fecd8ff730ae95b812db4d0571823ba3bd4d24f0254f872d7bbc5fbbccda2d
SHA3-384 hash: 7101dcd95f084431a2d647d43bc42ce8fcdcfaa4a880815abe313b617bfb4e0c44c0ca2f2648bcaa640660935917dac7
SHA1 hash: 05bc6e365ddecf33f83ecc69d6876dad714fdcd4
MD5 hash: abe874c0afb0587b33057cacddcd16f6
humanhash: single-washington-jig-double
File name:QUOTATION.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:416'038 bytes
First seen:2020-06-25 07:10:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:35/VmygMWSTuI4go5SLJch6ZTjJgOMjmg9aAsp:3VVmygMWSTB4gaSLJK6wmg1E
TLSH 859423E50BE8E5062B060B581E56333E4D59ABDD6F53BF0E55AC3CD15C9B2AC0F224A3
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: aldiyafa.com
Sending IP: 103.99.1.149
From: Lorenz Lorenzo <salesdxb@aldiyafa.com>
Subject: FW: QUOTATION
Attachment: QUOTATION.zip (contains "QUOTATION.exe")

AgentTesla SMTP exfil server:
mail.saamaygroup.com:587

AgentTesla SMTP exfil email address:
prabhatdey@saamaygroup.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21711.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86fecd8ff730ae95b812db4d0571823ba3bd4d24f0254f872d7bbc5fbbccda2d/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q37m3d7xgcxjloas3ngqk4mchor32tje6asu7bznpo6f7o6m3iwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 86fecd8ff730ae95b812db4d0571823ba3bd4d24f0254f872d7bbc5fbbccda2d

(this sample)

AgentTesla

Executable exe b9d2e9ef5ac762cc3961f222eab3b94a0d8b73e2fba5ef7ecd148fe016945f20

  
Dropping
MD5 4bd7c378da57ebab521b09e788befbe1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b9d2e9ef5ac762cc3961f222eab3b94a0d8b73e2fba5ef7ecd148fe016945f20

Comments