MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5da4cf63dd4a039633f0ae7091efc702e660369493464956d74979a0d6c6e982. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 3 Yara 3 Comments

SHA256 hash: 5da4cf63dd4a039633f0ae7091efc702e660369493464956d74979a0d6c6e982
SHA3-384 hash: e2575402e5777d50b4e5201d155714134fd25376c375d83f8116414f2a175520e43ef5f07bf7d495c6d7bb2467a11067
SHA1 hash: 4243d1993af0b5c46f8ed14b234fd093440319c7
MD5 hash: e092a6cf776c1b9c6f16287d6caa7ec6
humanhash: grey-oranges-video-eighteen
File name:RFQ_ENQ-02334.PDF.exe
Download: download sample
Signature AgentTesla
File size:997'888 bytes
First seen:2020-06-30 12:05:15 UTC
Last seen:2020-06-30 13:11:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 175f794d98c9dcb0b47ae1ab1087c22c
ssdeep 12288:h1JUuXUn6wUN4KSgqJ6wWska30/jgrTfz8BYnKFvkpzoMTK9tzxbz/YFFjUqAdt4:fOPXUWD6wEc0bp8RoMTKTNgmb0WOYi
TLSH D1259E22F2D28837D17326788D5BB395983EBE103D7858867BE50D4C5F396817C392A7
Reporter @abuse_ch
Tags:AgentTesla exe


Twitter
@abuse_ch
Malspam distributing AgentTesla:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.215
From: Taushif kapadia <office@jinpao.us>
Reply-To: info.farapan19@gmail.com
Subject: RFQ - Enquiry - ENQ-029/2020 R1 - Arabian Industries LLC - COB30-06-2020
Attachment: RFQ_ENQ-02334.PDF.z (contains "RFQ_ENQ-02334.PDF.exe")

AgentTesla SMTP exfil server:
smtp.yltab.com:587

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 2
# of downloads 27
Origin country US US
CAPE Sandbox Detection:n/a
Link: https://www.capesandbox.com/analysis/17101/
ClamAV PUA.Win.Adware.Slugin-6803969-0
PUA.Win.Adware.Slugin-6840354-0
CERT.PL MWDB Detection:agenttesla
Link: https://mwdb.cert.pl/sample/5da4cf63dd4a039633f0ae7091efc702e660369493464956d74979a0d6c6e982/
ReversingLabs :Status:Malicious
Threat name:Win32.Trojan.Delf
First seen:2020-06-30 12:07:04 UTC
AV detection:16 of 48 (33.33%)
Threat level:   5/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:agenttesla
Link: https://tria.ge/reports/200630-3hta2ne2hn/
Tags:spyware persistence keylogger trojan stealer family:agenttesla
VirusTotal:Virustotal results 39.73%

Yara Signatures


Rule name:Agenttesla_type2
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:CAP_HookExKeylogger
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:win_agent_tesla_w1
Author:govcert_ch
Description:Detect Agent Tesla based on common .NET code sequences

File information


The table below shows additional information about this malware sample such as delivery method and external references.

c094d6a7fab6cd6de1236fabbe858f04

AgentTesla

Executable exe 5da4cf63dd4a039633f0ae7091efc702e660369493464956d74979a0d6c6e982

(this sample)

  
Dropped by
MD5 c094d6a7fab6cd6de1236fabbe858f04
  
Delivery method
Distributed via e-mail attachment

Comments