MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cea2e32460f99229006310980272e87fe8a5f21a046cb286fadd6a26c664b77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9cea2e32460f99229006310980272e87fe8a5f21a046cb286fadd6a26c664b77
SHA3-384 hash: e85cd8aa94113ffbbd76bb0c29b89757c2118191c06468d2f27c1db48517c9d1e779bce8144f3fcb28bef8cc5f42211f
SHA1 hash: c80dac21ccd694f7353277145cdf3aa0c0825835
MD5 hash: 63e123e17d7ca86820a212d175ad9bb3
humanhash: neptune-nuts-avocado-magnesium
File name:Quote Items.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:403'834 bytes
First seen:2020-06-19 06:41:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:wcRCcmWhAbQgow+YClc1FZ7ktVqK5WtrJL4fZJqeR6+J5Wi+c4AUfuefteQCL:wcXwJo11lc1zwtfg9GJqePTWdccK
TLSH AA84236865DC059B89FDD828A8FB0E870CDAC49F8DA5555D4F8B9B137B30C790CA4CB2
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: agsystems.com
Sending IP: 95.211.208.25
From: Naim<donna.rodgers@agsystems.com>
Reply-To: Naim<nicolasdiegonicolas@gmail.com>
Subject: Re:BEST PRICE OFFER:18 June Order 2020:
Attachment: Quote Items.zip (contains "Quote Items.exe")

AgentTesla SMTP exfil server:
smtp.bapipl.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FakeAlert.9060.1798.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 18:51:29 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ttvc4msgb6msfeaggeeyajzoq77iuxzbubdmwkdpvxlke3dgjn3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 9cea2e32460f99229006310980272e87fe8a5f21a046cb286fadd6a26c664b77

(this sample)

AgentTesla

Executable exe ee84542a7345a20be96449b190580d2f0ef359753358339d30f0b1dcd4bec7f7

  
Dropping
MD5 5bb2397a559d359ae117f671048fa209
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ee84542a7345a20be96449b190580d2f0ef359753358339d30f0b1dcd4bec7f7

Comments