MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e1629303a071b6ac848921771c17591c02731875cbfb92c06d6f9d82d3e82fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e1629303a071b6ac848921771c17591c02731875cbfb92c06d6f9d82d3e82fb
SHA3-384 hash: c0a57355201137370829990c571c667c8f2ff32919c6b17425950e5ca1762eee4f369bb2be2209ebf505973a5fe120ac
SHA1 hash: 234e17165726e8023f333ebfe3b5f8ead973903d
MD5 hash: df71cc65b9d4970c952e83ef0db7659f
humanhash: high-fruit-coffee-nine
File name:RFQ_DN400_600CC3312.PDF.z
Download: download sample
Signature AgentTesla
Create hunting rule
File size:3'431'685 bytes
First seen:2020-08-13 09:36:28 UTC
Last seen:2020-08-13 09:36:44 UTC
File type: zip
MIME type:application/zip
ssdeep 98304:jiNH/RjyUIJgtYmippcfQ27A0N+t7Rk3L+Qp:+NHcUaDmiSQ27ArCb+q
TLSH 8EF533A1A4F5C9E10B1BFEB39B6280D1EA0611471117AC32C6D74B5327948BF6FDE9B0
Reporter abuse_ch
Tags:AgentTesla z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: impusa.com
Sending IP: 31.168.40.90
From: Carriso <sales@impusa.com>
Subject: RFQ_DN400_600CC3312.PDF
Attachment: RFQ_DN400_600CC3312.PDF.z (contains "RFQ_DN400CCC331G,PDF.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1e1629303a071b6ac848921771c17591c02731875cbfb92c06d6f9d82d3e82fb/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-13 09:38:07 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dylcsmb2a4nwvscisilxdqlvshacommhls73slag2345qlj6ql5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1e1629303a071b6ac848921771c17591c02731875cbfb92c06d6f9d82d3e82fb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 1e1629303a071b6ac848921771c17591c02731875cbfb92c06d6f9d82d3e82fb

(this sample)

AgentTesla

Executable exe 0a69136aed3f43352db370b595ab42f1de09e7de6cfddfee3248cf4e6b310709

  
Dropping
MD5 ca6ad7a9ebeb09cce5a3b58cf57ec137
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0a69136aed3f43352db370b595ab42f1de09e7de6cfddfee3248cf4e6b310709
  
Dropping
SHA256 e8527d7fa32591fe8781401e694edab0e8bcfdb12452e752caacd17c2432f9d2
  
Dropping
MD5 a4783f6c6a7dd060be8d12017ee424ec

Comments