MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 396982a79b9731d15ed130e4f2dbf01a14b243105bd58ad2edade78ee960042f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 396982a79b9731d15ed130e4f2dbf01a14b243105bd58ad2edade78ee960042f
SHA3-384 hash: a94ecb6d8b1c2931a2fff81b04699e09db9d661a3775091eb348843d019048797441b27455a8b9071bef4c54cde566e4
SHA1 hash: 91332329184fc5e38e90e27f48f43dfb5154345f
MD5 hash: 182f9ded93ba725b1d4d9a3d119880b3
humanhash: network-neptune-cat-minnesota
File name:URGENT_QUOTATION_PR 270473.xlxs.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:490'635 bytes
First seen:2020-08-31 09:16:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:dNPh0QCgpqGfb58/r4gplKQRHVBSPj36p1QysVrZeH:nh0QCaqGfNMr4+lKXOp1QXmH
TLSH 43A42313FEAE7DBEC87820A371B04999ED208B94D617D2F39430885B9FA1BE1535C42D
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: paulaner.orion.rs
Sending IP: 77.105.37.159
From: Tatika Widyasari <Tatika_Widyasari@cargills.com>
Subject: URGENT QUOTATION
Attachment: URGENT_QUOTATION_PR 270473.xlxs.zip (contains "URGENT_QUOTATION_PR #270473.xlxs.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.Trojan-7.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/396982a79b9731d15ed130e4f2dbf01a14b243105bd58ad2edade78ee960042f/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hfuyfj43s4y5cxwrgdspfw7qdikleqyqlpkyvuxnvxty52laaqxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/396982a79b9731d15ed130e4f2dbf01a14b243105bd58ad2edade78ee960042f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 396982a79b9731d15ed130e4f2dbf01a14b243105bd58ad2edade78ee960042f

(this sample)

AgentTesla

Executable exe 1eab0743a0c7a257a4e914404724f5ee37ed428aed24c341edc44f7878be9a52

  
Dropping
MD5 65020b545758df2c5a8b9397cc40d8e0
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1eab0743a0c7a257a4e914404724f5ee37ed428aed24c341edc44f7878be9a52

Comments