MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7c0fc77fcbb94c1d95afc67ac3b26cb761cfc3459115d5c0a8d9bf0fd25ba20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7c0fc77fcbb94c1d95afc67ac3b26cb761cfc3459115d5c0a8d9bf0fd25ba20
SHA3-384 hash: 1a1f9dacc73d4a7252653dbabc3fffea95f2f1b1dd2e0661c3a6c956fd36207cc2abe15a7a23c6aedd15189fb38f95db
SHA1 hash: dd262a9382097abb36aa8921b0bc823bccbddcc0
MD5 hash: 07bfd0ac088a8559f8c54aa309ea1b2b
humanhash: sad-illinois-venus-pennsylvania
File name:company details.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'093'265 bytes
First seen:2020-05-13 16:36:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:kY5u/c5w8f7t4unPJi6HrBMU7MlcngL9uZ9PpWcBsug2:Fukiut4gJi6Lj7MlAdpcuD
TLSH 453533391E8CFEFA1F505A8167205588C488CA46792F946C74FFD5F48324B26B8BD1DB
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: mailhost03.i3c.co.ug
Sending IP: 169.45.95.157
From: qcl@quality-chemicals.co.ug
Subject: Re: inquiry from Egypt
Attachment: company details.zip (contains "company details.exe")

AgentTesla SMTP exfil server:
smtp.ph1cool.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Script-AutoIt.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 17:36:42 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=47apy574xokmdwk27rt2yozgzn3bz7buleiv2xakrwn7b7jfxiqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip e7c0fc77fcbb94c1d95afc67ac3b26cb761cfc3459115d5c0a8d9bf0fd25ba20

(this sample)

AgentTesla

Executable exe a47b392ee3749782644cea8b41967b05fe9e7d76d75dcd2888e5ddc75f9963fd

  
Dropping
MD5 bd65a8230b989af10eb7e83ffd6404c0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a47b392ee3749782644cea8b41967b05fe9e7d76d75dcd2888e5ddc75f9963fd

Comments