MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de49b1e90182231c349cfb09bf631ecbbfd6752c6a83fca107e1b387ab042254. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de49b1e90182231c349cfb09bf631ecbbfd6752c6a83fca107e1b387ab042254
SHA3-384 hash: 0109e52e2c0bdd405d9bfc21c0d3c021e4406d2c80dbbb39af9e7a467179d2468f928bed8eb99bd4b8a1f12524db42b3
SHA1 hash: f4592120519703fa6bfa30347b0385c6880569da
MD5 hash: 59b915ec256efba862bc69d25a22dcb9
humanhash: kitten-georgia-mars-asparagus
File name:Machine Quotation.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:430'226 bytes
First seen:2020-06-26 11:38:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:epP5S5c8JHLtT9xqdCgq11MHtMcgguiC+1GvXoE24djIyKFf8ZaE36NCyo0J0dP9:ePSN99w9+rtdx936E7tdP10m5bXqG
TLSH CB9423CBCC9C0A7F684822D9D91AE70C70EDC964BB2171C7B760B6321C68797DAF5186
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: rdns0.hal-lndia.co.in
Sending IP: 104.223.196.89
From: Shingo Awaji <info@r-techno.co.jp>
Subject: Please quote machine
Attachment: Machine Quotation.zip (contains "FOB machine Quotation.exe")

AgentTesla SMTP exfil server:
ftp.ableacn.com:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Packer.BorlandDelphi-1
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Herz.B.20271.12226.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de49b1e90182231c349cfb09bf631ecbbfd6752c6a83fca107e1b387ab042254/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 11:40:05 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ze3d2ibqirryne47me36yy6zo75m5jmnkb7ziih4gzypkyeejka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip de49b1e90182231c349cfb09bf631ecbbfd6752c6a83fca107e1b387ab042254

(this sample)

AgentTesla

Executable exe 30e37124f75673a8862b10320d1ba3716adc8993e255e96d40523aa9722162bb

  
Dropping
MD5 f2e9e25b319bf1fe6bcdd066fe726ea9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 30e37124f75673a8862b10320d1ba3716adc8993e255e96d40523aa9722162bb

Comments