MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26c14b755b0eef03aef98ab677b372665de0c3a0b619f470905fd777ade8d56b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26c14b755b0eef03aef98ab677b372665de0c3a0b619f470905fd777ade8d56b
SHA3-384 hash: fdb470eb4b26e78e38c0dd23c8df74743295fc9c49fb0db0c2c33ee5e89f820e068a2e4fee04582ad52c966640f66e20
SHA1 hash: 39c589a1bad19cde2a069b66e2c75cd7c976da96
MD5 hash: 78d0cd09dcd2197ee41c8a8646d6c6d2
humanhash: hydrogen-robin-william-mountain
File name:Inquriy.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:1'010'940 bytes
First seen:2020-06-04 12:48:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:LFJHl5JYBjlfO8xDoapx0BUB38lrBUL1WPeacez2+:LFJHlfYBooVn0O9UUxWPi+
TLSH 6125331DF7CC7C899E251EEE09C997F8548A0827326FB6834E73D601AD293C6878953D
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: trentinternational.com
Sending IP: 95.211.208.50
From: Neenu | Trent <purchase1@trentinternational.com>
Subject:  Enquiry:06042020
Attachment: Inquriy.zip (contains "Inquriy.exe")

AgentTesla SMTP exfil server:
smtp.yandex.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27684.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27681.XorExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 13:36:24 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e3auw5k3b3xqhlxzrk3hpm3smzo6bq5awym7i4eql7lxplpi2vvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 26c14b755b0eef03aef98ab677b372665de0c3a0b619f470905fd777ade8d56b

(this sample)

AgentTesla

Executable exe 96e185894358d0c8c7f977fa2a586e6cf9e6e71ed2d6d23081633cd9d19c5367

  
Dropping
MD5 c9a9ff57937e7cfe9d793e2162810e59
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 96e185894358d0c8c7f977fa2a586e6cf9e6e71ed2d6d23081633cd9d19c5367

Comments