MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a3422935153a9ecea795e009f5df6fd69806b6f2689ca17dda35631d313edbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a3422935153a9ecea795e009f5df6fd69806b6f2689ca17dda35631d313edbb
SHA3-384 hash: b1559f6593012b0e95df8a5dd4e0ff557984fbc9f518e9af8ed584bee6b469e63c5198ebeb9d720e6eea8d9217740a22
SHA1 hash: 0e84a21a840a4b8aa987f7affbb9abaf9f9dc988
MD5 hash: 455f00791a72aacc3b51337ca4690ccf
humanhash: hamper-alpha-november-mobile
File name:QUOTATION_REQUEST.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'082'953 bytes
First seen:2020-06-01 19:41:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:xB2H2ksw1TlFBTNJOvzFX1NZY6o7EQS4JfgiM:D2p1RFBTNcvzFlNZY65kaiM
TLSH 523533369CDD1CF0553DEE1968A100B03BF5D7D68DC46C9A4D5A7302AAFCEAB8E158B0
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

From: Svizzera - FlavoursFragrances <flavours.fragrances@ecsa.ch>
Subject: Offer request Flavours & Fragrances
Attachment: QUOTATION_REQUEST.zip (contains "QUOTATION_REQUEST.exe")

AgentTesla SMTP exfil server:
smtp.sarniotex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 14:50:56 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ti2cfe2rkou6z2tzlyaj6xpw7vuya23pe2e4uf65unldduyt5w5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9a3422935153a9ecea795e009f5df6fd69806b6f2689ca17dda35631d313edbb

(this sample)

AgentTesla

Executable exe 6a617cbc6e41a2e0ab810d412877b47dff0f4e4a4e98f3f92b3041c3ec27652e

  
Dropping
MD5 084191a98803e956b9f5009e96d7a4fe
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6a617cbc6e41a2e0ab810d412877b47dff0f4e4a4e98f3f92b3041c3ec27652e

Comments