MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53c3f12590dbb597b5e8d03467e9bd3e70c2fcc091bd57bf45f1c69d307f29a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53c3f12590dbb597b5e8d03467e9bd3e70c2fcc091bd57bf45f1c69d307f29a8
SHA3-384 hash: 0bce73cbc8ec60825dfd5a60c5562973b4062501c663b0c6d0c21a8b1120570944d5514ac9840e60c6afaebf14605b35
SHA1 hash: 4d9784838e5c481fcbb6a16b0a95b415529e29d6
MD5 hash: a8c2b91d3b41c6bc9e3c08e15dbec225
humanhash: crazy-purple-florida-carolina
File name:RFQ 2046573 SNVI Group.zip
Download: download sample
Signature AgentTesla
Create hunting rule
File size:5'471'965 bytes
First seen:2020-08-14 06:10:50 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:FPsHtvJeGTCnFhZ1L4Syus1+SP5BrK/UTk6N0dVVZebNO:FPiJRm3uusky/5TVN0CO
TLSH A24633B3AB7033716BDB7D5914A311240E096FECA5252844377A36DF360F8E892B974B
Reporter abuse_ch
Tags:AgentTesla zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: vepo.donoralpha.com
Sending IP: 111.118.214.86
From: Emilia Garcia <groupe.snvi@snvigroupe.dz>
Subject: RFQ: 2046573 SNVI Group
Attachment: RFQ 2046573 SNVI Group.zip (contains "RFQ 2046573 SNVI Group.exe")

AgentTesla SMTP exfil server:
mail.nsmelectronics.com:587

AgentTesla SMTP exfil email address:
admim@nsmelectronics.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.AgentTesla-7660762-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53c3f12590dbb597b5e8d03467e9bd3e70c2fcc091bd57bf45f1c69d307f29a8/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 06:12:11 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kpb7cjmq3o2zpnpi2a2gp2n5hzymf7gasg6vpp2f6hdj2md7fgua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/53c3f12590dbb597b5e8d03467e9bd3e70c2fcc091bd57bf45f1c69d307f29a8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

zip 53c3f12590dbb597b5e8d03467e9bd3e70c2fcc091bd57bf45f1c69d307f29a8

(this sample)

AgentTesla

Executable exe 94bb69e726461f198145fac175e2e27ccc72534ae29db90cfaef683e726adec2

  
Dropping
MD5 f6acdf9607cf131519fc0f7cd218bad9
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 94bb69e726461f198145fac175e2e27ccc72534ae29db90cfaef683e726adec2

Comments