MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 974a41af303a982600585738940dac091146fd6aa855084702b43eb9efa691a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 974a41af303a982600585738940dac091146fd6aa855084702b43eb9efa691a2
SHA3-384 hash: adc64d8f96b1d29ce89b556c2095c8d3b98dbe7aeef4cba0096a2e2c0ea9fba26a79ee5367949ae50a925be5961141b5
SHA1 hash: 8e04ebe1a4cb3c1074c1794c1a95fe87b2c5465c
MD5 hash: bcdec96c82828e437dcccc76393449a0
humanhash: may-asparagus-king-football
File name:PRODUCT ENQUIRY APS 1217705 IQ.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:451'716 bytes
First seen:2020-06-25 12:36:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:abGXKpU8xXupR0vyEihM8uj4K5pF/ZrtUcvkfYf:aa6+Qeq3lXFFhScvkQf
TLSH 86A423B539EB18021D4F0111AB79C2E1977AC1413CF1B1F9C4ED4EE1B8A2F7A9A21779
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: nxcloud.nslfire.co.uk
Sending IP: 77.68.84.130
From: Arianne Souran <arianne@Sahicorporation.com>
Subject: INQUIRY : APS 1217705 IQ ------- Spec of products
Attachment: PRODUCT ENQUIRY APS 1217705 IQ.zip (contains "PRODUCT ENQUIRY APS 1217705 IQ.exe")

AgentTesla SMTP exfil server:
mail.amhec.com.sa:587

AgentTesla SMTP exfil email address:
shahbaz@amhec.com.sa

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.44022.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/974a41af303a982600585738940dac091146fd6aa855084702b43eb9efa691a2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 08:56:40 UTC
AV detection:
35 of 48 (72.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s5fedlzqhkmcmacyk44jidnmbeiun7lkvbkqqrycwq7lt35gsgra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 974a41af303a982600585738940dac091146fd6aa855084702b43eb9efa691a2

(this sample)

AgentTesla

Executable exe 453a64df6bb4a9b5ef79d9e4d3b179869dcd6bb9b01a02be8289c04276e5483d

  
Dropping
MD5 b5608304dcecb673c1fd4695f37ff310
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 453a64df6bb4a9b5ef79d9e4d3b179869dcd6bb9b01a02be8289c04276e5483d

Comments