MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ade7713687023af9c257171fe6e280d656832adff4437f09502243c6d2347cba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ade7713687023af9c257171fe6e280d656832adff4437f09502243c6d2347cba
SHA3-384 hash: 939f1251af155ede2d8d1970825d3d02ab388cb57e55c1aaae496f91b1cb15978208df915629adf4c404b82897533ea5
SHA1 hash: 0e4969bb964ccd4f1f39fa119a70b1c2db96b773
MD5 hash: a6c386b27e5dd24d5cac8ffa27123338
humanhash: football-south-triple-sweet
File name:inquiry Ref 72040034.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:473'537 bytes
First seen:2020-06-19 05:50:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:hoHTM4LOnTUlYe9/jfeHAcFgLCXXjHPr0Prl8n2iMMS:hL4qTUlN9LfeRc6AZ8n1Mh
TLSH 98A423B5C4985517D7BE4E86BB88D64FEA46CA37885580180303CF8EFDFA96215A70F3
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: nxcloud.nslfire.co.uk
Sending IP: 77.68.84.130
From: Christian Zeiler <C.Zeiler@tomaten.at>
Subject: Inquiry From Sailor Greenland GmbH
Attachment: inquiry Ref 72040034.zip (contains "inquiry Ref# 72040034.exe")

AgentTesla SMTP exfil server:
mail.amhec.com.sa:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.43622.22992.27446.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-19 05:52:05 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vxtxcnuhai5ptqsxc4p6nyua2zligkw76rbx6ckqejb4nurups5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip ade7713687023af9c257171fe6e280d656832adff4437f09502243c6d2347cba

(this sample)

AgentTesla

Executable exe b82e693dedd53f108f577be970b7b27951248512b1ebde80ac36be8a8521554c

  
Dropping
MD5 b7c9e0a64dc91fcaef50445f84d11240
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b82e693dedd53f108f577be970b7b27951248512b1ebde80ac36be8a8521554c

Comments